CVE-2026-78661

HighCVSS 7.5/10Last modified Nov 4, 2026

Description

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-407

Affected software

Vendor	Product	Versions
golang.org/x/net	golang.org/x/net/html	< 0.62.0

References

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-786627.5Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's CVE-2026-786639.1The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for a CVE-2026-786677.5When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excess CVE-2026-786697.5A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending ma CVE-2026-78677.8A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user CVE-2026-786737.5IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.CVE-2026-786748.8The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can le CVE-2026-786757.8GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by inclu CVE-2026-786769.8GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values CVE-2026-786777.5GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outsi CVE-2026-786786.5GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S option CVE-2026-786796.5GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypass