{"id":"CVE-2025-47911","aliases":["GHSA-w4gw-w5jq-g9jh","GO-2026-4440"],"title":"The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS)…","titleSource":"OSV","descriptionSource":"OSV","description":"The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.","severity":"medium","score":5.3,"published":"2026-02-05T18:16:09.893Z","modified":"2026-10-28T17:27:14.749Z","withdrawn":false,"knownExploited":false,"affected":[],"sourceAffected":[{"ranges":[],"versions":[]}],"references":["https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c","https://pkg.go.dev/vuln/GO-2026-4440","https://github.com/golang/vulndb/issues/4440","https://go.dev/cl/709876"],"sources":[{"name":"OSV","id":"CVE-2025-47911","modified":"2026-10-28T17:27:14.749239929Z","url":"https://osv.dev/vulnerability/CVE-2025-47911"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T00:55:32.564Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}