CVE-2025-47911

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected software

No affected versions have been published.

Timeline

Published
Feb 5, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-479125.3The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 pCVE-2025-479137.5SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.CVE-2025-479145.3SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the meCVE-2025-479169.8Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within thCVE-2025-479179.8Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation.CVE-2025-47929.8A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the componenCVE-2025-479289.1Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `CVE-2025-479292.1DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerabilityCVE-2025-47939.8A vulnerability was found in PHPGurukul Online Course Registration 3.1. It has been classified as critical. Affected is an unknown function CVE-2025-479305.3Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" acceCVE-2025-479316.1LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) VuCVE-2025-479326.1Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a da