Vulnerability GO-2026-6860
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
16 days ago
October 27, 2026 at 09:16 PM UTC
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
<0.62.0
<0.62.0
Summary
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
Details
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies.
Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
16 days ago
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
<0.62.0 GO-2026-6866
<0.62.0 GO-2026-6866
Unknown
1 month ago
HTTP/2 server memory exhaustion due to Trailer headers in net/http
<0.60.0 GO-2026-6603
<0.60.0 GO-2026-6603
Unknown
1 month ago
HTTP/2 transport accepts malformed framing-related headers in net/http
<0.60.0 GO-2026-6610
<0.60.0 GO-2026-6610
Unknown
1 month ago
Excessive CPU consumption from repeated initial window changes in net/http
<0.60.0 GO-2026-6611
<0.60.0 GO-2026-6611
Unknown
1 month ago
Double flow control refund on HTTP/2 server streams in net/http
<0.60.0 GO-2026-6612
<0.60.0 GO-2026-6612
Impacted packages
Timeline
Published
16 days ago
October 27, 2026 at 09:16 PM UTC
Fixed (v0.62.0)
17 days ago
October 27, 2026 at 07:00 PM UTC
Last Modified
16 days ago
October 27, 2026 at 09:30 PM UTC