CVE catalog

CVE-2025-47911

Go Networking vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.57% · Oct 25, 2026

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-golang-x-netsid1:0.61.0-1fixed
Debiangolang-golang-x-netforky1:0.61.0-1fixed
Debiangolang-golang-x-nettrixie1:0.27.0-2vulnerable
Debiangolang-golang-x-netbookworm1:0.7.0+dfsg-1vulnerable
Ubuntugolang-golang-x-netnobleNot reportedvulnerable
Ubuntugolang-golang-x-netnoble1:0.21.0+dfsg-1ubuntu0.1~esm2fixed
Ubuntugolang-golang-x-net-devnoble1:0.21.0+dfsg-1ubuntu0.1~esm2fixed
Gogolang.org/x/netNot reported0.45.0fixed
Ubuntugolang-golang-x-net22.041:0.0+git20210119.5f4716e+dfsg-4vulnerable
Ubuntugolang-golang-x-net22.041:0.0+git20210805.aaa1db6+dfsg-1vulnerable
Ubuntugolang-golang-x-net22.041:0.0+git20211209.491a49a+dfsg-1vulnerable
Ubuntugolang-golang-x-net22.041:0.0+git20211209.491a49a+dfsg-1ubuntu0.1fixed
Susekubevirt-1.6linux enterprise module for containers 15 sp71.6.6-150700.15.17.1fixed
Opensusecontainerized-data-importer1.66tumbleweed1.66.0-1.1fixed
Opensusekubevirt1.9tumbleweed1.9.0-1.1fixed
Susekubevirt-1.6linux enterprise module for containers 15 sp71.6.6-150700.15.7.1fixed
Susekubevirtlinux enterprise module for containers 15 sp71.7.4-150700.3.24.2fixed
Opensusegitea-tealeap 16.00.12.0-bp160.1.1fixed
Opensusehelmleap 16.03.19.1-160000.1.1fixed
Opensusekeplerleap 16.00.11.3-160000.1.1fixed
Opensusesbctlleap 16.00.18-bp160.1.1fixed
Opensusealloyleap 16.01.12.1-160000.1.1fixed
Opensuseapptainertumbleweed1.4.5-2.1fixed
Opensuseshadowsocks-v2ray-pluginleap 16.05.25.0-bp160.1.1fixed
Opensusev2ray-coreleap 16.05.40.0-bp160.1.1fixed
Opensusegitea-tealeap 16.00.11.1-bp160.1.1fixed
Opensusekeplertumbleweed0.11.3-1.1fixed
Opensusetrivytumbleweed0.68.2-1.1fixed
Opensusealloytumbleweed1.12.0-2.1fixed
Opensusesbctltumbleweed0.18-2.1fixed
Opensusego-sendxmpptumbleweed0.15.1-1.1fixed
Opensusehelmtumbleweed3.19.1-1.1fixed
Opensusegoogle-osconfig-agenttumbleweed20251028.00-1.1fixed
Opensusegomukstumbleweed0.3.1-2.1fixed
Opensusegrafanatumbleweed11.6.7-1.1fixed
Opensusegit-bugtumbleweed0.10.1-2.1fixed
Opensuseollamatumbleweed0.12.6-1.1fixed
Opensusev2ray-coretumbleweed5.40.0-1.1fixed
Opensuseheadscaletumbleweed0.26.1-2.1fixed
Opensusegitea-teatumbleweed0.11.0-2.1fixed
Opensuseforgejo-longtermtumbleweed11.0.6-2.1fixed
Opensuseforgejotumbleweed12.0.4-2.1fixed
Opensusedistrobuildertumbleweed3.2-4.1fixed
Opensuseglowtumbleweed2.1.1-2.1fixed
Susehelmlinux micro 6.23.19.1-160000.1.1fixed
Susealloylinux enterprise server 16.01.12.1-160000.1.1fixed
Susealloylinux enterprise server for sap applications 16.01.12.1-160000.1.1fixed
Suseapptainerlinux enterprise module for hpc 15 sp71.4.5-150600.4.15.1fixed
Opensuseapptainerleap 15.61.4.5-150600.4.15.1fixed
Susealloylinux enterprise module for basesystem 15 sp71.12.1-150700.15.12.1fixed
Susehelmlinux enterprise micro 5.53.19.1-150000.1.57.1fixed
Susehelmlinux enterprise module for containers 15 sp63.19.1-150000.1.57.1fixed
Susehelmlinux enterprise module for containers 15 sp73.19.1-150000.1.57.1fixed
Susehelmlinux enterprise module for package hub 15 sp63.19.1-150000.1.57.1fixed
Susehelmlinux enterprise module for package hub 15 sp73.19.1-150000.1.57.1fixed
Susehelmlinux enterprise high performance computing 15 sp3-ltss3.19.1-150000.1.57.1fixed
Susehelmlinux enterprise high performance computing 15 sp4-espos3.19.1-150000.1.57.1fixed
Susehelmlinux enterprise high performance computing 15 sp4-ltss3.19.1-150000.1.57.1fixed
Susehelmlinux enterprise high performance computing 15 sp5-espos3.19.1-150000.1.57.1fixed
Susehelmlinux enterprise high performance computing 15 sp5-ltss3.19.1-150000.1.57.1fixed
Susehelmlinux enterprise server 15 sp3-ltss3.19.1-150000.1.57.1fixed
Susehelmlinux enterprise server 15 sp4-ltss3.19.1-150000.1.57.1fixed
Susehelmlinux enterprise server 15 sp5-ltss3.19.1-150000.1.57.1fixed
Susehelmlinux enterprise server for sap applications 15 sp33.19.1-150000.1.57.1fixed
Susehelmlinux enterprise server for sap applications 15 sp43.19.1-150000.1.57.1fixed
Susehelmlinux enterprise server for sap applications 15 sp53.19.1-150000.1.57.1fixed
Susehelmenterprise storage 7.13.19.1-150000.1.57.1fixed
Opensusehelmleap 15.63.19.1-150000.1.57.1fixed
Susehelmlinux micro 6.13.19.1-slfo.1.1_1.1fixed
Susehelmlinux micro 6.03.19.1-1.1fixed
Opensusepocketbasetumbleweed0.40.5-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-golang-x-netsourcesid1:0.47.0-1not yet assignedNot reported[1127321]
Debiangolang-golang-x-netsourceforky1:0.47.0-1not yet assignedNot reported[1127321]
Debiangolang-golang-x-netsourcetrixie(unfixed)not yet assignedNot reported[1127321]
Debiangolang-golang-x-netsourcebookworm(unfixed)not yet assignedNot reported[1127321]
Ubuntugolang-golang-x-netdebnoble1:0.21.0+dfsg-1ubuntu0.1~esm2Not reportedNot reportedNot reported
Ubuntugolang-golang-x-net-devdebnoble1:0.21.0+dfsg-1ubuntu0.1~esm2Not reportedNot reportedNot reported
Gogolang.org/x/netGoNot reported0.45.0Not reportedNot reportedNot reported
Ubuntugolang-golang-x-netdeb22.041:0.0+git20211209.491a49a+dfsg-1ubuntu0.1Not reportedUSN-8900-1Not reported
Susekubevirt-1.6rpmlinux enterprise module for containers 15 sp71.6.6-150700.15.17.1Not reportedSUSE-SU-2026:3630-1Not reported
Opensusecontainerized-data-importer1.66rpmtumbleweed1.66.0-1.1Not reportedOPENSUSE-SU-2026:11514-1Not reported
Opensusekubevirt1.9rpmtumbleweed1.9.0-1.1Not reportedOPENSUSE-SU-2026:11520-1Not reported
Susekubevirt-1.6rpmlinux enterprise module for containers 15 sp71.6.6-150700.15.7.1Not reportedSUSE-SU-2026:2401-1Not reported
Susekubevirtrpmlinux enterprise module for containers 15 sp71.7.4-150700.3.24.2Not reportedSUSE-SU-2026:2400-1Not reported
Opensusegitea-tearpmleap 16.00.12.0-bp160.1.1Not reportedOPENSUSE-SU-2026:20318-1Not reported
Opensusehelmrpmleap 16.03.19.1-160000.1.1Not reportedOPENSUSE-SU-2026:20327-1Not reported
Opensusekeplerrpmleap 16.00.11.3-160000.1.1Not reportedOPENSUSE-SU-2026:20206-1Not reported
Opensusesbctlrpmleap 16.00.18-bp160.1.1Not reportedOPENSUSE-SU-2026:20105-1Not reported
Opensusealloyrpmleap 16.01.12.1-160000.1.1Not reportedOPENSUSE-SU-2026:20044-1Not reported
Opensuseapptainerrpmtumbleweed1.4.5-2.1Not reportedOPENSUSE-SU-2026:10173-1Not reported
Opensuseshadowsocks-v2ray-pluginrpmleap 16.05.25.0-bp160.1.1Not reportedOPENSUSE-SU-2025:20128-1Not reported
Opensusev2ray-corerpmleap 16.05.40.0-bp160.1.1Not reportedOPENSUSE-SU-2025:20128-1Not reported
Opensusegitea-tearpmleap 16.00.11.1-bp160.1.1Not reportedOPENSUSE-SU-2025:20118-1Not reported
Opensusekeplerrpmtumbleweed0.11.3-1.1Not reportedOPENSUSE-SU-2025:15854-1Not reported
Opensusetrivyrpmtumbleweed0.68.2-1.1Not reportedOPENSUSE-SU-2025:15852-1Not reported
Opensusealloyrpmtumbleweed1.12.0-2.1Not reportedOPENSUSE-SU-2025:15830-1Not reported
Opensusesbctlrpmtumbleweed0.18-2.1Not reportedOPENSUSE-SU-2025:15743-1Not reported
Opensusego-sendxmpprpmtumbleweed0.15.1-1.1Not reportedOPENSUSE-SU-2025:15729-1Not reported
Opensusehelmrpmtumbleweed3.19.1-1.1Not reportedOPENSUSE-SU-2025:15730-1Not reported
Opensusegoogle-osconfig-agentrpmtumbleweed20251028.00-1.1Not reportedOPENSUSE-SU-2025:15709-1Not reported
Opensusegomuksrpmtumbleweed0.3.1-2.1Not reportedOPENSUSE-SU-2025:15689-1Not reported
Opensusegrafanarpmtumbleweed11.6.7-1.1Not reportedOPENSUSE-SU-2025:15669-1Not reported
Opensusegit-bugrpmtumbleweed0.10.1-2.1Not reportedOPENSUSE-SU-2025:15654-1Not reported
Opensuseollamarpmtumbleweed0.12.6-1.1Not reportedOPENSUSE-SU-2025:15647-1Not reported
Opensusev2ray-corerpmtumbleweed5.40.0-1.1Not reportedOPENSUSE-SU-2025:15624-1Not reported
Opensuseheadscalerpmtumbleweed0.26.1-2.1Not reportedOPENSUSE-SU-2025:15620-1Not reported
Opensusegitea-tearpmtumbleweed0.11.0-2.1Not reportedOPENSUSE-SU-2025:15619-1Not reported
Opensuseforgejo-longtermrpmtumbleweed11.0.6-2.1Not reportedOPENSUSE-SU-2025:15618-1Not reported
Opensuseforgejorpmtumbleweed12.0.4-2.1Not reportedOPENSUSE-SU-2025:15617-1Not reported
Opensusedistrobuilderrpmtumbleweed3.2-4.1Not reportedOPENSUSE-SU-2025:15616-1Not reported
Opensuseglowrpmtumbleweed2.1.1-2.1Not reportedOPENSUSE-SU-2025:15607-1Not reported
Susehelmrpmlinux micro 6.23.19.1-160000.1.1Not reportedSUSE-SU-2026:20685-1Not reported
Susealloyrpmlinux enterprise server 16.01.12.1-160000.1.1Not reportedSUSE-SU-2026:20089-1Not reported
Susealloyrpmlinux enterprise server for sap applications 16.01.12.1-160000.1.1Not reportedSUSE-SU-2026:20089-1Not reported
Suseapptainerrpmlinux enterprise module for hpc 15 sp71.4.5-150600.4.15.1Not reportedSUSE-SU-2026:0580-1Not reported
Opensuseapptainerrpmleap 15.61.4.5-150600.4.15.1Not reportedSUSE-SU-2026:0580-1Not reported
Susealloyrpmlinux enterprise module for basesystem 15 sp71.12.1-150700.15.12.1Not reportedSUSE-SU-2026:0028-1Not reported
Susehelmrpmlinux enterprise micro 5.53.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise module for containers 15 sp63.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise module for containers 15 sp73.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise module for package hub 15 sp63.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise module for package hub 15 sp73.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp3-ltss3.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp4-espos3.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp4-ltss3.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp5-espos3.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp5-ltss3.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise server 15 sp3-ltss3.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise server 15 sp4-ltss3.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise server 15 sp5-ltss3.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise server for sap applications 15 sp33.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise server for sap applications 15 sp43.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux enterprise server for sap applications 15 sp53.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmenterprise storage 7.13.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Opensusehelmrpmleap 15.63.19.1-150000.1.57.1Not reportedSUSE-SU-2025:4190-1Not reported
Susehelmrpmlinux micro 6.13.19.1-slfo.1.1_1.1Not reportedSUSE-SU-2025:21221-1Not reported
Susehelmrpmlinux micro 6.03.19.1-1.1Not reportedSUSE-SU-2025:21043-1Not reported
Opensusepocketbaserpmtumbleweed0.40.5-1.1Not reportedOPENSUSE-SU-2026:12167-1Not reported

[Debian bug #1127321]

Notes

[trixie] golang-golang-x-net: Minor issue [bookworm] golang-golang-x-net: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [golang-golang-x-net]

    Details (2)
    • 1:0.7.0+dfsg-1 · all · bookworm

      Affected

      usn · golang-golang-x-net · debian · bookworm; usn · golang-golang-x-net · debian · 12

    • 1:0.7.0+dfsg-1 · all · bookworm

      Affected

      usn · golang-golang-x-net · debian · bookworm; usn · golang-golang-x-net · debian · 12

[Debian 13 (Trixie)]

  • Source package: [golang-golang-x-net]

    Details (4)
    • 1:0.27.0-2 · all · trixie

      Affected

      usn · golang-golang-x-net · debian · 13

    • 1:0.27.0-2 · all · trixie

      Affected

      usn · golang-golang-x-net · debian · 13

    • 1:0.53.0-2~bpo13+1 · all · trixie-backports

      Affected

      usn · golang-golang-x-net · debian · 13

    • 1:0.53.0-2~bpo13+1 · all · trixie-backports

      Affected

      usn · golang-golang-x-net · debian · 13

[openSUSE Tumbleweed]

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]