Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-05 | 2 | Disclosure2 |
| 2026-02-13 | 1 | Disclosure1 |
| 2026-03-08 | 1 | Patch1 |
| 2026-06-16 | 1 | Patch1 |
CVE-2025-47911 The html.Parse function in http://golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an atta… https://www.cve.org/CVERecord?id=CVE-2025-47911
Post summary
The post describes a DoS vulnerability in Go's html.Parse due to quadratic parsing complexity but provides no PoC, exploit, or patch.
SUSE released fixes for kubevirt 1.6 and 1.7 addressing CVE-2025-47911, CVE-2025-47913 and CVE-2025-47914 privilege escalation and denial-of-service bugs in embedded Go components, Linuxsecurity reported. https://threatcluster.io/cluster/critical-vulnerabilities-in-suse-kubevirt-and-opensuse-trivy-ce749196
Post summary
SUSE released patches for kubevirt 1.6/1.7 to address privilege escalation and denial‑of‑service bugs (CVE‑2025‑47911, 47913, 47914). No evidence of active exploitation is reported.
Heads-up, #openSUSE devs! 🐧 A new security advisory (2026:0074-1) is out for gitea-tea, bumping it to v0.12.0. It's a moderate-severity fix for two CVEs (CVE-2025-47911, CVE-2025-58190) but also packs a punch with new features. Read more: 👉https://tinyurl.com/mwbaz9ee #Security https://t.co/s70kW6Wyvz
Post summary
The tweet announces an openSUSE security advisory for gitea‑tea, noting a patch to v0.12.0 that resolves CVE‑2025‑47911 and CVE‑2025‑58190, thereby providing a moderate‑severity fix.
CVE-2025-47911: Death by a Thousand Tags: The Quadratic HTML DoS in Go In the world of safe memory languages, we often forget that algorithmic complexity is a vulnerability class of its own. CVE-2025-47911 serves as a stark reminder: you don't need a ... https://cvereports.com/reports/CVE-2025-47911
Post summary
The post announces a new DoS vulnerability in Go’s HTML parsing (CVE‑2025‑47911) highlighting algorithmic complexity as the root cause, without offering PoC, exploit, or patch details.
CVE-2025-47911 Quadratic Complexity Denial of Service in http://golang.org/x/net/html P... https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-47911 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet announces CVE‑2025‑47911 as a quadratic‑complexity DoS vulnerability in golang.org/x/net/html, providing no PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | go | html | - | go | - |