Golang html Package Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the html package of golang.org/x/net, prior to version 0.45.0. The issue arises in the Parse function, which can enter an infinite loop when processing certain specially crafted HTML inputs. This flaw can cause the parsing operation to execute much more slowly than expected or to never complete, effectively leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes an infinite loop during HTML parsing, leading to a denial-of-service condition where the application becomes unresponsive or significantly delayed in processing.

Remediation

Users can update to golang.org/x/net version 0.45.0 or later, where this vulnerability has been fixed.