CVE-2025-58190: Infinite parsing loop in golang.org/x/net
Last updated 7 October 2026
Other sources
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-golang-x-netto a version that resolves this vulnerability.Fixed in 1:0.58.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58190?
CVE-2025-58190 has a severity rating that allows it to cause denial of service (DoS) through infinite parsing loops.
How do I fix CVE-2025-58190?
To fix CVE-2025-58190, update your golang.org/x/net/html package to the latest version that addresses the vulnerability.
What type of vulnerability is CVE-2025-58190?
CVE-2025-58190 is a denial of service vulnerability caused by an infinite parsing loop.
Who is affected by CVE-2025-58190?
Any software utilizing the golang.org/x/net/html package to parse HTML content is affected by CVE-2025-58190.
What systems are vulnerable to CVE-2025-58190?
Systems that rely on the golang.org/x/net/html for HTML parsing are vulnerable to CVE-2025-58190.