CVE-2025-47911: Quadratic parsing complexity in golang.org/x/net/html
Last updated 7 October 2026
Other sources
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/golang.org/x/net/htmlto a version that resolves this vulnerability.Fixed in 0.45.0 - Upgrade
Upgrade
debian/golang-golang-x-netto a version that resolves this vulnerability.Fixed in 1:0.58.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47911?
CVE-2025-47911 is classified as a denial of service (DoS) vulnerability due to its potential for quadratic parsing complexity.
How do I fix CVE-2025-47911?
There are no specific patches mentioned for CVE-2025-47911, but avoiding untrusted HTML content and updating to newer versions of the affected library, if available, could help mitigate the risk.
What causes the vulnerability in CVE-2025-47911?
CVE-2025-47911 is caused by the html.Parse function's inefficient processing of certain inputs, leading to quadratic parsing complexity.
Which software is affected by CVE-2025-47911?
CVE-2025-47911 affects the golang.org/x/net/html package in Go programming language.
Can CVE-2025-47911 be exploited remotely?
Yes, an attacker can exploit CVE-2025-47911 remotely by delivering specially crafted HTML content to trigger the denial of service condition.