{"id":"GO-2026-6860","aliases":["CVE-2026-78661"],"title":"Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net","titleSource":"OSV","descriptionSource":"OSV","description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","severity":"unknown","score":null,"published":"2026-10-27T21:16:18.000Z","modified":"2026-10-27T21:38:56.517Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Go","name":"golang.org/x/net","sources":[{"name":"OSV · GO-2026-6860","url":"https://osv.dev/vulnerability/GO-2026-6860"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.62.0"}],"type":"SEMVER"}],"versions":[],"fixed":["0.62.0"]}],"sourceAffected":[],"references":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"sources":[{"name":"OSV","id":"GO-2026-6860","modified":"2026-10-27T21:30:04.890809062Z","url":"https://osv.dev/vulnerability/GO-2026-6860"},{"name":"CVE","id":"CVE-2026-78661","modified":"2026-10-27T21:38:56.517Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-78661"}],"assessments":[],"products":[{"vendor":"golang.org/x/net","name":"golang.org/x/net/html","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.62.0","versionType":"semver"}],"defaultStatus":"unaffected","source":"Go","url":"https://www.cve.org/CVERecord?id=CVE-2026-78661"}],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T09:10:39.623Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}