Golang HTML Parser Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the HTML parsing component of the Golang x/net package, prior to version 0.55.0. The issue arises from a cubic complexity algorithm used during the construction of the HTML tree, which can lead to excessive CPU consumption when parsing arbitrary HTML. This vulnerability was reported by IPC Labs.

Impact

Exploitation of this vulnerability can cause excessive CPU usage, potentially leading to a denial-of-service condition.

Remediation

Users can upgrade to Golang x/net version 0.55.0 or later to address this vulnerability.