CVE catalog
CVE-2026-25680
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.33% · Oct 25, 2026
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | golang-golang-x-net | sid | 1:0.61.0-1 | fixed |
| Debian | golang-golang-x-net | forky | 1:0.61.0-1 | fixed |
| Debian | golang-golang-x-net | trixie | 1:0.27.0-2 | vulnerable |
| Debian | golang-golang-x-net | bookworm | 1:0.7.0+dfsg-1 | vulnerable |
| Cpe | golang-golang-x-net | Not reported | Not reported | vulnerable |
| Cpe | net | Not reported | 0.55.0 | fixed |
| Go | golang.org/x/net | Not reported | 0.55.0 | fixed |
| Suse | kubevirt | linux enterprise module for containers 15 sp7 | 1.7.4-150700.3.30.1 | fixed |
| Opensuse | zabbix | tumbleweed | 7.0.28-1.1 | fixed |
| Suse | cosign | linux enterprise server 16.0 | 3.1.1-160000.1.1 | fixed |
| Suse | cosign | linux enterprise server for sap applications 16.0 | 3.1.1-160000.1.1 | fixed |
| Suse | alloy | linux enterprise server 16.0 | 1.17.0-160000.1.1 | fixed |
| Suse | alloy | linux enterprise server for sap applications 16.0 | 1.17.0-160000.1.1 | fixed |
| Opensuse | cosign | leap 16.0 | 3.1.1-160000.1.1 | fixed |
| Suse | cosign | linux enterprise module for basesystem 15 sp7 | 3.1.1-150400.3.45.1 | fixed |
| Suse | cosign | linux enterprise high performance computing 15 sp4-espos | 3.1.1-150400.3.45.1 | fixed |
| Suse | cosign | linux enterprise high performance computing 15 sp4-ltss | 3.1.1-150400.3.45.1 | fixed |
| Suse | cosign | linux enterprise high performance computing 15 sp5-espos | 3.1.1-150400.3.45.1 | fixed |
| Suse | cosign | linux enterprise high performance computing 15 sp5-ltss | 3.1.1-150400.3.45.1 | fixed |
| Suse | cosign | linux enterprise server 15 sp4-ltss | 3.1.1-150400.3.45.1 | fixed |
| Suse | cosign | linux enterprise server 15 sp5-ltss | 3.1.1-150400.3.45.1 | fixed |
| Suse | cosign | linux enterprise server 15 sp6-ltss | 3.1.1-150400.3.45.1 | fixed |
| Suse | cosign | linux enterprise server for sap applications 15 sp4 | 3.1.1-150400.3.45.1 | fixed |
| Suse | cosign | linux enterprise server for sap applications 15 sp5 | 3.1.1-150400.3.45.1 | fixed |
| Suse | cosign | linux enterprise server for sap applications 15 sp6 | 3.1.1-150400.3.45.1 | fixed |
| Opensuse | hauler | leap 16.0 | 2.0.1-bp160.1.1 | fixed |
| Opensuse | alloy | leap 16.0 | 1.17.0-160000.1.1 | fixed |
| Opensuse | cosign | tumbleweed | 3.1.1-1.1 | fixed |
| Opensuse | amfora | tumbleweed | 1.11.0-3.1 | fixed |
| Opensuse | mcphost | leap 16.0 | 0.34.0-160000.2.1 | fixed |
| Opensuse | grafana | leap 16.0 | 11.6.14+security04-bp160.2.1 | fixed |
| Suse | mcphost | linux micro 6.2 | 0.34.0-160000.2.1 | fixed |
| Suse | mcphost | linux enterprise server 16.0 | 0.34.0-160000.2.1 | fixed |
| Suse | mcphost | linux enterprise server for sap applications 16.0 | 0.34.0-160000.2.1 | fixed |
| Opensuse | alloy | tumbleweed | 1.17.0-1.1 | fixed |
| Opensuse | neonmodem | leap 16.0 | 1.0.7+git0.346d1d3-bp160.1.1 | fixed |
| Opensuse | trivy | leap 16.0 | 0.71.0-160000.1.1 | fixed |
| Suse | elemental-toolkit | linux micro 6.1 | 2.2.9-slfo.1.1_1.1 | fixed |
| Suse | elemental-toolkit | linux micro 6.0 | 2.1.6-1.1 | fixed |
| Opensuse | grafana | tumbleweed | 11.6.14+security04-3.1 | fixed |
| Ubuntu | golang-golang-x-net-dev | pro | 1:0.0+git20190811.74dc4d7+dfsg-1 | vulnerable |
| Ubuntu | golang-golang-x-net-dev | pro | 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | golang-golang-x-net-dev | pro | 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2 | vulnerable |
| Ubuntu | golang-golang-x-net-dev | pro | 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3 | vulnerable |
| Opensuse | git-bug | tumbleweed | 0.10.1-5.1 | fixed |
| Opensuse | hauler | tumbleweed | 1.4.3-5.1 | fixed |
| Opensuse | trivy | tumbleweed | 0.71.0-1.1 | fixed |
| Opensuse | yq | tumbleweed | 4.53.2-2.1 | fixed |
| Opensuse | mcphost | tumbleweed | 0.34.0-8.1 | fixed |
| Opensuse | rclone | tumbleweed | 1.74.2-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | golang-golang-x-net | source | sid | 1:0.55.0-1 | not yet assigned | Not reported | Not reported |
| Debian | golang-golang-x-net | source | forky | 1:0.55.0-1 | not yet assigned | Not reported | Not reported |
| Debian | golang-golang-x-net | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | golang-golang-x-net | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Cpe | net | cpe | Not reported | 0.55.0 | Not reported | Not reported | Not reported |
| Go | golang.org/x/net | Go | Not reported | 0.55.0 | Not reported | GHSA-5CV4-JP36-H3MW | Not reported |
| Suse | kubevirt | rpm | linux enterprise module for containers 15 sp7 | 1.7.4-150700.3.30.1 | Not reported | SUSE-SU-2026:3203-1 | Not reported |
| Opensuse | zabbix | rpm | tumbleweed | 7.0.28-1.1 | Not reported | OPENSUSE-SU-2026:11304-1 | Not reported |
| Suse | cosign | rpm | linux enterprise server 16.0 | 3.1.1-160000.1.1 | Not reported | SUSE-SU-2026:22613-1 | Not reported |
| Suse | cosign | rpm | linux enterprise server for sap applications 16.0 | 3.1.1-160000.1.1 | Not reported | SUSE-SU-2026:22613-1 | Not reported |
| Suse | alloy | rpm | linux enterprise server 16.0 | 1.17.0-160000.1.1 | Not reported | SUSE-SU-2026:22575-1 | Not reported |
| Suse | alloy | rpm | linux enterprise server for sap applications 16.0 | 1.17.0-160000.1.1 | Not reported | SUSE-SU-2026:22575-1 | Not reported |
| Opensuse | cosign | rpm | leap 16.0 | 3.1.1-160000.1.1 | Not reported | OPENSUSE-SU-2026:21281-1 | Not reported |
| Suse | cosign | rpm | linux enterprise module for basesystem 15 sp7 | 3.1.1-150400.3.45.1 | Not reported | SUSE-SU-2026:2827-1 | Not reported |
| Suse | cosign | rpm | linux enterprise high performance computing 15 sp4-espos | 3.1.1-150400.3.45.1 | Not reported | SUSE-SU-2026:2827-1 | Not reported |
| Suse | cosign | rpm | linux enterprise high performance computing 15 sp4-ltss | 3.1.1-150400.3.45.1 | Not reported | SUSE-SU-2026:2827-1 | Not reported |
| Suse | cosign | rpm | linux enterprise high performance computing 15 sp5-espos | 3.1.1-150400.3.45.1 | Not reported | SUSE-SU-2026:2827-1 | Not reported |
| Suse | cosign | rpm | linux enterprise high performance computing 15 sp5-ltss | 3.1.1-150400.3.45.1 | Not reported | SUSE-SU-2026:2827-1 | Not reported |
| Suse | cosign | rpm | linux enterprise server 15 sp4-ltss | 3.1.1-150400.3.45.1 | Not reported | SUSE-SU-2026:2827-1 | Not reported |
| Suse | cosign | rpm | linux enterprise server 15 sp5-ltss | 3.1.1-150400.3.45.1 | Not reported | SUSE-SU-2026:2827-1 | Not reported |
| Suse | cosign | rpm | linux enterprise server 15 sp6-ltss | 3.1.1-150400.3.45.1 | Not reported | SUSE-SU-2026:2827-1 | Not reported |
| Suse | cosign | rpm | linux enterprise server for sap applications 15 sp4 | 3.1.1-150400.3.45.1 | Not reported | SUSE-SU-2026:2827-1 | Not reported |
| Suse | cosign | rpm | linux enterprise server for sap applications 15 sp5 | 3.1.1-150400.3.45.1 | Not reported | SUSE-SU-2026:2827-1 | Not reported |
| Suse | cosign | rpm | linux enterprise server for sap applications 15 sp6 | 3.1.1-150400.3.45.1 | Not reported | SUSE-SU-2026:2827-1 | Not reported |
| Opensuse | hauler | rpm | leap 16.0 | 2.0.1-bp160.1.1 | Not reported | OPENSUSE-SU-2026:21262-1 | Not reported |
| Opensuse | alloy | rpm | leap 16.0 | 1.17.0-160000.1.1 | Not reported | OPENSUSE-SU-2026:21251-1 | Not reported |
| Opensuse | cosign | rpm | tumbleweed | 3.1.1-1.1 | Not reported | OPENSUSE-SU-2026:11198-1 | Not reported |
| Opensuse | amfora | rpm | tumbleweed | 1.11.0-3.1 | Not reported | OPENSUSE-SU-2026:11152-1 | Not reported |
| Opensuse | mcphost | rpm | leap 16.0 | 0.34.0-160000.2.1 | Not reported | OPENSUSE-SU-2026:21120-1 | Not reported |
| Opensuse | grafana | rpm | leap 16.0 | 11.6.14+security04-bp160.2.1 | Not reported | OPENSUSE-SU-2026:20984-1 | Not reported |
| Suse | mcphost | rpm | linux micro 6.2 | 0.34.0-160000.2.1 | Not reported | SUSE-SU-2026:22226-1 | Not reported |
| Suse | mcphost | rpm | linux enterprise server 16.0 | 0.34.0-160000.2.1 | Not reported | SUSE-SU-2026:22193-1 | Not reported |
| Suse | mcphost | rpm | linux enterprise server for sap applications 16.0 | 0.34.0-160000.2.1 | Not reported | SUSE-SU-2026:22193-1 | Not reported |
| Opensuse | alloy | rpm | tumbleweed | 1.17.0-1.1 | Not reported | OPENSUSE-SU-2026:11053-1 | Not reported |
| Opensuse | neonmodem | rpm | leap 16.0 | 1.0.7+git0.346d1d3-bp160.1.1 | Not reported | OPENSUSE-SU-2026:20963-1 | Not reported |
| Opensuse | trivy | rpm | leap 16.0 | 0.71.0-160000.1.1 | Not reported | OPENSUSE-SU-2026:20956-1 | Not reported |
| Suse | elemental-toolkit | rpm | linux micro 6.1 | 2.2.9-slfo.1.1_1.1 | Not reported | SUSE-SU-2026:22074-1 | Not reported |
| Suse | elemental-toolkit | rpm | linux micro 6.0 | 2.1.6-1.1 | Not reported | SUSE-SU-2026:22065-1 | Not reported |
| Opensuse | grafana | rpm | tumbleweed | 11.6.14+security04-3.1 | Not reported | OPENSUSE-SU-2026:11013-1 | Not reported |
| Opensuse | git-bug | rpm | tumbleweed | 0.10.1-5.1 | Not reported | OPENSUSE-SU-2026:10949-1 | Not reported |
| Opensuse | hauler | rpm | tumbleweed | 1.4.3-5.1 | Not reported | OPENSUSE-SU-2026:10933-1 | Not reported |
| Opensuse | trivy | rpm | tumbleweed | 0.71.0-1.1 | Not reported | OPENSUSE-SU-2026:10941-1 | Not reported |
| Opensuse | yq | rpm | tumbleweed | 4.53.2-2.1 | Not reported | OPENSUSE-SU-2026:10930-1 | Not reported |
| Opensuse | mcphost | rpm | tumbleweed | 0.34.0-8.1 | Not reported | OPENSUSE-SU-2026:10923-1 | Not reported |
| Opensuse | rclone | rpm | tumbleweed | 1.74.2-1.1 | Not reported | OPENSUSE-SU-2026:10856-1 | Not reported |
Notes
[trixie] golang-golang-x-net: Minor issue [bookworm] golang-golang-x-net: Limited support, minor issue; html parse CPU DoS
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [golang-golang-x-net-dev]Affected
Source package: [golang-golang-x-net]
Details (2)
1:0.7.0+dfsg-1· all · bookwormAffected
nvd · golang-golang-x-net · debian · bookworm; nvd · golang-golang-x-net · debian · 12
1:0.7.0+dfsg-1· all · bookwormAffected
nvd · golang-golang-x-net · debian · bookworm; nvd · golang-golang-x-net · debian · 12
[Debian 13 (Trixie)]
- [golang-golang-x-net-dev]Affected
Source package: [golang-golang-x-net]
Details (4)
1:0.27.0-2· all · trixieAffected
nvd · golang-golang-x-net · debian · 13
1:0.27.0-2· all · trixieAffected
nvd · golang-golang-x-net · debian · 13
1:0.53.0-2~bpo13+1· all · trixie-backportsAffected
nvd · golang-golang-x-net · debian · 13
1:0.53.0-2~bpo13+1· all · trixie-backportsAffected
nvd · golang-golang-x-net · debian · 13
[openSUSE Tumbleweed]
- [cosign-bash-completion]Unknown
Source package: [cosign]
Details (1)
3.1.2-1.2· noarch · tumbleweedUnknown · Fixed:
3.1.1-1.1Version impact unknown
nvd · cosign · opensuse · tumbleweed
- [cosign-fish-completion]Unknown
Source package: [cosign]
Details (1)
3.1.2-1.2· noarch · tumbleweedUnknown · Fixed:
3.1.1-1.1Version impact unknown
nvd · cosign · opensuse · tumbleweed
- [cosign-zsh-completion]Unknown
Source package: [cosign]
Details (1)
3.1.2-1.2· noarch · tumbleweedUnknown · Fixed:
3.1.1-1.1Version impact unknown
nvd · cosign · opensuse · tumbleweed
- [git-bug-bash-completion]Unknown
Source package: [git-bug]
Details (1)
0.10.1-6.3· noarch · tumbleweedUnknown · Fixed:
0.10.1-5.1Version impact unknown
nvd · git-bug · opensuse · tumbleweed
- [git-bug-fish-completion]Unknown
Source package: [git-bug]
Details (1)
0.10.1-6.3· noarch · tumbleweedUnknown · Fixed:
0.10.1-5.1Version impact unknown
nvd · git-bug · opensuse · tumbleweed
- [git-bug-zsh-completion]Unknown
Source package: [git-bug]
Details (1)
0.10.1-6.3· noarch · tumbleweedUnknown · Fixed:
0.10.1-5.1Version impact unknown
nvd · git-bug · opensuse · tumbleweed
- [mcphost-bash-completion]Unknown
Source package: [mcphost]
Details (1)
0.34.0-9.2· noarch · tumbleweedUnknown · Fixed:
0.34.0-8.1Version impact unknown
nvd · mcphost · opensuse · tumbleweed
- [mcphost-fish-completion]Unknown
Source package: [mcphost]
Details (1)
0.34.0-9.2· noarch · tumbleweedUnknown · Fixed:
0.34.0-8.1Version impact unknown
nvd · mcphost · opensuse · tumbleweed
- [mcphost-zsh-completion]Unknown
Source package: [mcphost]
Details (1)
0.34.0-9.2· noarch · tumbleweedUnknown · Fixed:
0.34.0-8.1Version impact unknown
nvd · mcphost · opensuse · tumbleweed
- [rclone-bash-completion]Unknown
Source package: [rclone]
Details (1)
1.75.0-1.1· noarch · tumbleweedUnknown · Fixed:
1.74.2-1.1Version impact unknown
nvd · rclone · opensuse · tumbleweed
- [rclone-zsh-completion]Unknown
Source package: [rclone]
Details (1)
1.75.0-1.1· noarch · tumbleweedUnknown · Fixed:
1.74.2-1.1Version impact unknown
nvd · rclone · opensuse · tumbleweed
- [system-user-zabbix]Unknown
Source package: [zabbix]
Details (1)
7.0.28-1.2· noarch · tumbleweedUnknown · Fixed:
7.0.28-1.1Version impact unknown
nvd · zabbix · opensuse · tumbleweed
- [yq-bash-completion]Unknown
Source package: [yq]
Details (1)
4.53.3-2.1· noarch · tumbleweedUnknown · Fixed:
4.53.2-2.1Version impact unknown
nvd · yq · opensuse · tumbleweed
- [yq-fish-completion]Unknown
Source package: [yq]
Details (1)
4.53.3-2.1· noarch · tumbleweedUnknown · Fixed:
4.53.2-2.1Version impact unknown
nvd · yq · opensuse · tumbleweed
- [yq-zsh-completion]Unknown
Source package: [yq]
Details (1)
4.53.3-2.1· noarch · tumbleweedUnknown · Fixed:
4.53.2-2.1Version impact unknown
nvd · yq · opensuse · tumbleweed
- [zabbix-agent]Unknown
Source package: [zabbix]
Details (1)
7.0.28-1.2· x86_64 · tumbleweedUnknown · Fixed:
7.0.28-1.1Version impact unknown
nvd · zabbix · opensuse · tumbleweed
- [zabbix-agent2]Unknown
Source package: [zabbix]
Details (1)
7.0.28-1.2· x86_64 · tumbleweedUnknown · Fixed:
7.0.28-1.1Version impact unknown
nvd · zabbix · opensuse · tumbleweed
- [zabbix-java-gateway]Unknown
Source package: [zabbix]
Details (1)
7.0.28-1.2· noarch · tumbleweedUnknown · Fixed:
7.0.28-1.1Version impact unknown
nvd · zabbix · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_3630-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-25680]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-25680]
- [https://osv.dev/vulnerability/GHSA-5cv4-jp36-h3mw]
- [https://osv.dev/vulnerability/SUSE-SU-2026:22065-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:22074-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:22193-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:22226-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:22575-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:22613-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:2827-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3203-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-25680]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10856-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10923-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10930-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10933-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10941-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10949-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11013-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11053-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11152-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11198-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11304-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20956-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20963-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20984-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21120-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21251-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21262-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21281-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-25680]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25680.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1653.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]