CVE-2025-47911: Quadratic parsing complexity in golang.org/x/net/html
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/golang.org/x/net/htmlto a version that resolves this vulnerability.Fixed in 0.45.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47911?
CVE-2025-47911 is classified as a denial of service (DoS) vulnerability due to its potential for quadratic parsing complexity.
How do I fix CVE-2025-47911?
There are no specific patches mentioned for CVE-2025-47911, but avoiding untrusted HTML content and updating to newer versions of the affected library, if available, could help mitigate the risk.
What causes the vulnerability in CVE-2025-47911?
CVE-2025-47911 is caused by the html.Parse function's inefficient processing of certain inputs, leading to quadratic parsing complexity.
Which software is affected by CVE-2025-47911?
CVE-2025-47911 affects the golang.org/x/net/html package in Go programming language.
Can CVE-2025-47911 be exploited remotely?
Yes, an attacker can exploit CVE-2025-47911 remotely by delivering specially crafted HTML content to trigger the denial of service condition.