6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25680

CVE-2026-25680: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25680

CVE-2026-25680:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
golang.org/x/net	go	< 0.55.0	0.55.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch 08be507abce89191d78cd49da60f4501fc910472 for the golang.org/x/net package clearly indicates that the vulnerability is located in the html/parse.go file. The commit message explicitly states that it is fixing a performance issue in the "Noah's Ark clause" to mitigate a denial-of-service vulnerability (CVE-2026-25680). The code changes pinpoint the parser.addFormattingElement function as the location of the vulnerability. The patch removes a highly inefficient, nested-loop-based attribute comparison and replaces it with a more performant method that sorts attributes and then compares them. This change directly addresses the root cause of the excessive CPU consumption. Therefore, any runtime profile during the exploitation of this vulnerability would show significant time spent within the parser.addFormattingElement function.

Vulnerable functions

parser.addFormattingElement

html/parse.go

The vulnerability lies in the `addFormattingElement` function, specifically in the implementation of the "Noah's Ark clause". The original code used a nested loop to compare attributes of formatting elements, resulting in a time complexity that could be exploited. An attacker could provide crafted HTML with numerous attributes, causing the parser to consume excessive CPU time in these nested loops, leading to a denial of service. The patch replaces this inefficient, near-cubic complexity comparison with a much faster approach that involves sorting the attributes and using `slices.Equal`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.