PT-2026-42779 · Go+1 · Golang.Org/X/Net+1

Ipc Labs · Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-25680

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description Parsing arbitrary HTML can consume excessive CPU time, which may lead to a denial of service (a condition where a system becomes unavailable to its intended users).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-25680

GO-2026-5028

Affected Products

Golang.Org/X/Net

Golang.Org/X/Net/Html

References · 5

• https://osv.dev/vulnerability/GO-2026-5028 · Vendor Advisory
• https://pkg.go.dev/vuln/GO-2026-5028 · Note
• https://go.dev/cl/781702 · Note
• https://go.dev/issue/79573 · Note
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 · Note