REDHAT-BUG-2437110: Medium severity golang.org/x/net/html vulnerability

Published Feb 5, 2026

Updated

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Affected Software

1 affected component

golang.org/x/net/html

Event History

Feb 5, 2026

Data Sourced

via Red Hat·06:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2437110?

The severity of REDHAT-BUG-2437110 is medium, rated at 4.

What causes the vulnerability REDHAT-BUG-2437110?

The vulnerability REDHAT-BUG-2437110 is caused by the html.Parse function in golang.org/x/net/html entering an infinite parsing loop with certain specially crafted HTML inputs.

How can an attacker exploit REDHAT-BUG-2437110?

An attacker can exploit REDHAT-BUG-2437110 by providing specially crafted HTML content that triggers the infinite loop during parsing, leading to a denial of service.

How do I mitigate REDHAT-BUG-2437110?

To mitigate REDHAT-BUG-2437110, avoid using the vulnerable version of golang.org/x/net/html and apply any available patches or updates.

Is there a fix available for REDHAT-BUG-2437110?

Yes, a fix for REDHAT-BUG-2437110 is available in subsequent releases of golang.org/x/net/html following the identification of the vulnerability.