Unrated
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing...
CVE-2026-78661
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| golang.org/x/net | golang.org/x/net/html |
< 0.62.0 |
0.62.0 |
| Go | golang.org/x/net |
< 0.62.0 |
0.62.0 |
Original description The description as published by the source.
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web go.dev
- web go.dev
- web groups.google.com
- web pkg.go.dev
- web nvd.nist.gov
- web github.com