{"id":"CVE-2026-25680","title":"golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing (CVE-2026-25680)","summary":"A flaw was found in golang.org/x/net/html. A remote attacker could provide specially crafted HTML, which, when parsed by the affected component, would consume excessive CPU resources. This could lead to a Denial of Service (DoS) condition,…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-1050","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["assisted_installer_for_red_hat_openshift_container_platform 2","builds_for_red_hat_openshift","cert_manager_operator_for_red_hat_openshift","confidential_compute_attestation","cryostat 4","external_secrets_operator_for_red_hat_openshift","fence_agents_remediation_operator","file_integrity_operator","gatekeeper 3","logging_subsystem_for_red_hat_openshift","logical_volume_manager_storage","migration_toolkit_for_applications 8","migration_toolkit_for_containers","multiarch_tuning_operator","multicluster_engine_for_kubernetes","multicluster_global_hub","network_observability_operator","node_healthcheck_operator","openshift_api_for_data_protection","openshift_pipelines","openshift_serverless","openshift_service_mesh 3","3scale_api_management_platform 2","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","ansible_automation_platform 2","ceph_storage 5","ceph_storage 7","ceph_storage 8","ceph_storage 9","connectivity_link 1","developer_hub","edge_manager 1","enterprise_linux 10","enterprise_linux 9","lightspeed_for_runtimes_operator","openshift_ai_rhoai","openshift_cluster_manager_cli","openshift_container_platform 4","openshift_data_foundation 4"],"patched":["cert_manager_support_for_red_hat_openshift_release 1.17","cluster_observability_operator 1.5.3","openshift_api_for_data_protection 1.6","openshift_data_foundation 4.22","multicluster_engine_for_kubernetes 2.11"],"published":"2026-05-22","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:34:01+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25680.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25680.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-25680"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480760"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25680"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25680"},{"url":"https://go.dev/cl/781702"},{"url":"https://go.dev/issue/79573"},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"},{"url":"https://pkg.go.dev/vuln/GO-2026-5028"},{"url":"https://access.redhat.com/errata/RHSA-2026:82322"},{"url":"https://access.redhat.com/errata/RHSA-2026:82304"},{"url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"url":"https://access.redhat.com/errata/RHSA-2026:43692"},{"url":"https://access.redhat.com/errata/RHSA-2026:37387"},{"url":"https://access.redhat.com/errata/RHSA-2026:57194"},{"url":"https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472"},{"url":"https://go.googlesource.com/net/+/refs/tags/v0.55.0"},{"url":"cs.opensource.google/go/x/net"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00326,"epssPercentile":0.25587,"aliases":["GHSA-5cv4-jp36-h3mw","GO-2026-5028"],"ecosystem":"go","ingestedAt":"2026-09-12T03:13:01.755Z","slug":"CVE-2026-25680","body":"## Overview\n\nA flaw was found in golang.org/x/net/html. A remote attacker could provide specially crafted HTML, which, when parsed by the affected component, would consume excessive CPU resources. This could lead to a Denial of Service (DoS) condition, making the system unavailable to legitimate users.\n\n## Vendor advisories\n\n- **RHSA-2026:82322** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.17 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82322)\n- **RHSA-2026:82304** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.17 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82304)\n- **RHSA-2026:34342** · Red Hat · fixed in: Cluster Observability Operator 1.5.3 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34342)\n- **RHSA-2026:43692** · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43692)\n- **RHSA-2026:37387** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.22 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37387)\n- **RHSA-2026:57194** · Red Hat · fixed in: multicluster engine for Kubernetes 2.11 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57194)\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, Cryostat 4, External Secrets Operator for Red Hat OpenShift, … · no fix planned: Cryostat 4, Red Hat 3scale API Management Platform 2, Red Hat Service Interconnect 2, Red Hat Trusted Artifact Signer, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25680.json)\n\n**golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing** — rated Moderate by Red Hat. Released 2026-05-22, updated 2026-10-15.\n\nAffected:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Confidential Compute Attestation\n- Cryostat 4\n- External Secrets Operator for Red Hat OpenShift\n- Fence Agents Remediation Operator\n- File Integrity Operator\n- Gatekeeper 3\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Multiarch Tuning Operator\n- Multicluster Engine for Kubernetes\n- Multicluster Global Hub\n- Network Observability Operator\n- Node HealthCheck Operator\n- OpenShift API for Data Protection\n- OpenShift Pipelines\n- OpenShift Serverless\n- OpenShift Service Mesh 3\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Connectivity Link 1\n- Red Hat Developer Hub\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Lightspeed for Runtimes Operator\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Cluster Manager CLI\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n\nFixed:\n\n- Cert Manager support for Red Hat OpenShift release 1.17\n- Cluster Observability Operator 1.5.3\n- OpenShift API for Data Protection 1.6\n- Red Hat Openshift Data Foundation 4.22\n- multicluster engine for Kubernetes 2.11\n\nNo fix planned:\n\n- Cryostat 4\n- Red Hat 3scale API Management Platform 2\n- Red Hat Service Interconnect 2\n- Red Hat Trusted Artifact Signer\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Confidential Compute Attestation\n- External Secrets Operator for Red Hat OpenShift\n- Fence Agents Remediation Operator\n- File Integrity Operator\n- Gatekeeper 3\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Multiarch Tuning Operator\n- Multicluster Engine for Kubernetes\n- Multicluster Global Hub\n- Network Observability Operator\n- Node HealthCheck Operator\n- OpenShift API for Data Protection\n- OpenShift Pipelines\n- OpenShift Serverless\n- OpenShift Service Mesh 3\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Connectivity Link 1\n- Red Hat Developer Hub\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Lightspeed for Runtimes Operator\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Cluster Manager CLI\n\nNot affected:\n\n- Cluster Observability Operator 1.5.3\n- OpenShift API for Data Protection 1.6\n- Red Hat Openshift Data Foundation 4.22\n- Compliance Operator\n- multicluster engine for Kubernetes 2.11\n- Multicluster Engine for Kubernetes\n- OpenShift Developer Tools and Services\n- OpenShift Lightspeed\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:82322\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:82304\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:34342\n\nWorkarounds / mitigations:\n\n- Update affected Go applications to use golang.org/x/net version 0.55.0 or later. As a workaround, do not use golang.org/x/net/html to parse untrusted HTML content, or enforce timeouts on HTML parsing operations. Applications that do not parse arbitrary HTML are not affected.\n\n## Package advisory (CVE-2026-25680)\n\nAffected packages:\n\n- `golang.org/x/net < 0.55.0`\n\nPatched in:\n\n- `golang.org/x/net 0.55.0`\n\nSource: https://osv.dev/vulnerability/GHSA-5cv4-jp36-h3mw","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}