Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-25680

36
FAUCET Score

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

First published: May 22, 2026Last modified: May 22, 2026

Impacted Technologies

VendorProductVersion(s)CPE
< 0.55.0CPE matchmatch criteria
cpe:2.3:a:golang:net:*:*:*:*:*:go:*:*

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.33%
Probability of exploitation in next 30 days
EPSS Percentile
25.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0033 is in the 25th percentile among its peer group of 26,219 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (73)

gopatch availablevia ghsa
Product: golang.org/x/netFixed in: 0.55.0
microsoftpatch availablevia msrc
Product: 21378-17084Fixed in: 1.30.10-25
microsoftpatch availablevia msrc
Product: 21414-17084Fixed in: 3.7.0-6
microsoftpatch availablevia msrc
Product: 21409-17084Fixed in: 2.27.0-12
microsoftpatch availablevia msrc
Product: 21408-17084Fixed in: 0.14.0-14
microsoftpatch availablevia msrc
Product: 20984-17084Fixed in: 1.12.15-8
microsoftpatch availablevia msrc
Product: 21475-17084Fixed in: 1.4.0-6
microsoftpatch availablevia msrc
Product: 21276-17084Fixed in: 1.62.0-5
microsoftpatch availablevia msrc
Product: 20991-17084Fixed in: 1.32.0-6
microsoftpatch availablevia msrc
Product: 21359-17084Fixed in: 2.8.1-4
microsoftpatch availablevia msrc
Product: 21476-17084Fixed in: 2.8.1-4
microsoftpatch availablevia msrc
Product: 21281-17084Fixed in: 2.7.5-17
microsoftpatch availablevia msrc
Product: 21008-17084Fixed in: 0.0.10-6
microsoftpatch availablevia msrc
Product: 21256-17084Fixed in: 1.30.10-25
microsoftpatch availablevia msrc
Product: 21299-17084Fixed in: 1.7.1-5
microsoftpatch availablevia msrc
Product: 20966-17084Fixed in: 1.9.5-14
microsoftpatch availablevia msrc
Product: 20981-17084Fixed in: 1.7.7-4
microsoftpatch availablevia msrc
Product: 21015-17084Fixed in: 0.12.0-6
microsoftpatch availablevia msrc
Product: 21020-17084Fixed in: 3.7.0-6
microsoftpatch availablevia msrc
Product: 21505-17084Fixed in: 8.7.11-7
microsoftpatch availablevia msrc
Product: 21406-17084Fixed in: 0.5.1-5
microsoftpatch availablevia msrc
Product: 21506-17084Fixed in: 0.5.1-5
microsoftpatch availablevia msrc
Product: 21407-17084Fixed in: 2.2.4-3
microsoftpatch availablevia msrc
Product: 21413-17084Fixed in: 4.0.2-9
microsoftpatch availablevia msrc
Product: 21508-17084Fixed in: 4.0.2-9
microsoftpatch availablevia msrc
Product: 21507-17084Fixed in: 2.2.4-4
microsoftpatch availablevia msrc
Product: 21408-17084Fixed in: 0.14.0-15
microsoftpatch availablevia msrc
Product: 21409-17084Fixed in: 2.27.0-13
microsoftpatch availablevia msrc
Product: 21412-17084Fixed in: 2.14.1-14
microsoftpatch availablevia msrc
Product: 21554-17084Fixed in: 2.14.1-14
microsoftpatch availablevia msrc
Product: 21502-17084Fixed in: 2.14.1-14
microsoftpatch availablevia msrc
Product: 21395-17084Fixed in: 1.31.0-23
microsoftpatch availablevia msrc
Product: 21481-17084Fixed in: 1.31.0-23
microsoftpatch availablevia msrc
Product: 21555-17084Fixed in: 2.62.0-17
microsoftpatch availablevia msrc
Product: 21399-17084Fixed in: 2.62.0-17
microsoftpatch availablevia msrc
Product: 21503-17084Fixed in: 2.62.0-17
microsoftpatch availablevia msrc
Product: 21402-17084Fixed in: 8.7.11-7
microsoftpatch availablevia msrc
Product: azl3 containerized-data-importer 1.62.0-3 on Azure Linux 3.0Fixed in: 1.62.0-5
microsoftpatch availablevia msrc
Product: azl3 cri-tools 1.32.0-4 on Azure Linux 3.0Fixed in: 1.32.0-6
microsoftpatch availablevia msrc
Product: azl3 dasel 2.8.1-3 on Azure Linux 3.0Fixed in: 2.8.1-4
microsoftpatch availablevia msrc
Product: azl3 packer 1.9.5-13 on Azure Linux 3.0Fixed in: 1.9.5-14
microsoftpatch availablevia msrc
Product: azl3 prometheus-adapter 0.12.0-5 on Azure Linux 3.0Fixed in: 0.12.0-6
microsoftpatch availablevia msrc
Product: azl3 sriov-network-device-plugin 3.7.0-5 on Azure Linux 3.0Fixed in: 3.7.0-6
microsoftpatch availablevia msrc
Product: azl3 sriov-network-device-plugin 3.7.0-6 on Azure Linux 3.0Fixed in: 3.7.0-6
microsoftpatch availablevia msrc
Product: azl3 docker-buildx 0.14.0-13 on Azure Linux 3.0Fixed in: 0.14.0-15
microsoftpatch availablevia msrc
Product: azl3 docker-compose 2.27.0-11 on Azure Linux 3.0Fixed in: 2.27.0-13
microsoftpatch availablevia msrc
Product: azl3 keda 2.14.1-13 on Azure Linux 3.0Fixed in: 2.14.1-14
microsoftpatch availablevia msrc
Product: azl3 telegraf 1.31.0-22 on Azure Linux 3.0Fixed in: 1.31.0-23
microsoftpatch availablevia msrc
Product: azl3 telegraf 1.31.0-23 on Azure Linux 3.0Fixed in: 1.31.0-23
microsoftpatch availablevia msrc
Product: azl3 gh 2.62.0-16 on Azure Linux 3.0Fixed in: 2.62.0-17
microsoftpatch availablevia msrc
Product: azl3 gh 2.62.0-17 on Azure Linux 3.0Fixed in: 2.62.0-17
microsoftpatch availablevia msrc
Product: azl3 cf-cli 8.7.11-7 on Azure Linux 3.0Fixed in: 8.7.11-7
microsoftpatch availablevia msrc
Product: azl3 cloud-provider-kubevirt 0.5.1-4 on Azure Linux 3.0Fixed in: 0.5.1-5
microsoftpatch availablevia msrc
Product: azl3 application-gateway-kubernetes-ingress 1.7.7-3 on Azure Linux 3.0Fixed in: 1.7.7-4
microsoftpatch availablevia msrc
Product: azl3 cert-manager 1.12.15-6 on Azure Linux 3.0Fixed in: 1.12.15-8
microsoftpatch availablevia msrc
Product: azl3 cni-plugins 1.4.0-5 on Azure Linux 3.0Fixed in: 1.4.0-6
microsoftpatch availablevia msrc
Product: azl3 cni-plugins 1.4.0-6 on Azure Linux 3.0Fixed in: 1.4.0-6
microsoftpatch availablevia msrc
Product: azl3 dasel 2.8.1-4 on Azure Linux 3.0Fixed in: 2.8.1-4
microsoftpatch availablevia msrc
Product: azl3 influxdb 2.7.5-15 on Azure Linux 3.0Fixed in: 2.7.5-17
microsoftpatch availablevia msrc
Product: azl3 kube-vip-cloud-provider 0.0.10-5 on Azure Linux 3.0Fixed in: 0.0.10-6
microsoftpatch availablevia msrc
Product: azl3 kubernetes 1.30.10-23 on Azure Linux 3.0Fixed in: 1.30.10-25
microsoftpatch availablevia msrc
Product: azl3 kubernetes 1.30.10-25 on Azure Linux 3.0Fixed in: 1.30.10-25
microsoftpatch availablevia msrc
Product: azl3 kubevirt 1.7.1-2 on Azure Linux 3.0Fixed in: 1.7.1-5
microsoftpatch availablevia msrc
Product: azl3 keda 2.14.1-15 on Azure Linux 3.0Fixed in: 2.14.1-14
microsoftpatch availablevia msrc
Product: azl3 keda 2.14.1-14 on Azure Linux 3.0Fixed in: 2.14.1-14
microsoftpatch availablevia msrc
Product: azl3 gh 2.62.0-18 on Azure Linux 3.0Fixed in: 2.62.0-17
microsoftpatch availablevia msrc
Product: azl3 cf-cli 8.7.11-6 on Azure Linux 3.0Fixed in: 8.7.11-7
microsoftpatch availablevia msrc
Product: azl3 cloud-provider-kubevirt 0.5.1-5 on Azure Linux 3.0Fixed in: 0.5.1-5
microsoftpatch availablevia msrc
Product: azl3 containerd2 2.2.4-2 on Azure Linux 3.0Fixed in: 2.2.4-3
microsoftpatch availablevia msrc
Product: azl3 multus 4.0.2-8 on Azure Linux 3.0Fixed in: 4.0.2-9
microsoftpatch availablevia msrc
Product: azl3 multus 4.0.2-9 on Azure Linux 3.0Fixed in: 4.0.2-9
microsoftpatch availablevia msrc
Product: 21358-17084Fixed in: 1.4.0-6
microsoftpatch availablevia msrc
Product: azl3 containerd2 2.2.4-4 on Azure Linux 3.0Fixed in: 2.2.4-4

Vendor Advisories (2)

goGHSA-5cv4-jp36-h3mwmedium

Go Net HTML parser is vulnerable to denial of service

May 26, 2026
microsoft2026-May/CVE-2026-25680Moderate

Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

May 12, 2026

References

go.dev / cl/781702
Issue Tracking
go.dev / issue/79573
Issue Tracking
groups.google.com / g/golang-announce/c/iI-mYSI0lu8
Mailing List
pkg.go.dev / vuln/GO-2026-5028
Vendor Advisory