REDHAT-BUG-2437109: Medium severity golang.org/x/net/html vulnerability
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2437109?
The severity of REDHAT-BUG-2437109 is classified as medium with a risk score of 4.
What is the primary vulnerability described in REDHAT-BUG-2437109?
REDHAT-BUG-2437109 describes a vulnerability in the html.Parse function that can result in denial of service when handling specially crafted HTML inputs.
How do I fix REDHAT-BUG-2437109?
To fix REDHAT-BUG-2437109, update to the latest version of the golang.org/x/net/html package that addresses this vulnerability.
What type of attack does REDHAT-BUG-2437109 enable?
REDHAT-BUG-2437109 enables a denial of service (DoS) attack through quadratic parsing complexity in the html.Parse function.
When was REDHAT-BUG-2437109 published?
REDHAT-BUG-2437109 was published on February 5, 2026.