GO-2026-6860

    Dashboard / Vulnerabilities / GO-2026-6860

    GO-2026-6860

    Published: 27 Oct 2026Last Modified: 27 Oct 2026

    Summary: Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

    Details: When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

    References: https://go.dev/cl/849365, https://go.dev/issue/82224, https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs

    Affected packages

    Package

    Name: golang.org/x/net

    Purl: pkg:golang/golang.org/x/net

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.62.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High