CVE-2026-78661 golang.org/x/net CVE debrief

Who should care

Defenders responsible for Go applications that parse HTML, particularly those using the affected golang.org/x/net package, should assess exposure and apply remediation to prevent potential performance degradation and increased risk of DoS attacks. This includes reviewing and updating Go applications to use the fixed version of the package, monitoring for potential performance issues, and verifying affected scope, severity, and vendor guidance.

Why it matters

The CVE-2026-78661 vulnerability in golang.org/x/net can cause quadratic complexity when coalescing text nodes in HTML, potentially leading to performance issues and increased risk of DoS attacks. Defenders should assess exposure and apply remediation.

• Potential performance degradation due to quadratic complexity
• Increased risk of denial-of-service (DoS) attacks
• Need for remediation and version updates in affected systems

Technical summary

The vulnerability arises from inefficient string concatenation during parsing of HTML text nodes in the golang.org/x/net package. This can lead to O(n^2) allocations and byte copies for inputs with many short text runs separated by ignored end tags. The issue affects Go applications that parse HTML using the golang.org/x/net package, and defenders should assess exposure and apply remediation to prevent potential performance degradation and increased risk of DoS attacks. The CVE Program and NVD records provide relevant information on the issue.

Defensive priority

Defenders should prioritize assessing exposure and applying remediation for systems using the affected golang.org/x/net package, particularly in Go applications that parse HTML.

Recommended defensive actions

• Assess exposure and apply remediation for systems using the affected golang.org/x/net package
• Review and update Go applications that parse HTML to use the fixed version of the package
• Monitor for potential performance issues in affected systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is described in the source item from osv_dev, which provides details on the issue and its potential impact. The CVE Program and NVD records also provide relevant information. The issue is caused by inefficient string concatenation during parsing of HTML text nodes, leading to O(n^2) allocations and byte copies. Defenders should verify affected scope, severity, and vendor guidance to assess exposure and apply remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.