{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://pkg.go.dev","packageName":"golang.org/x/net/html","product":"golang.org/x/net/html","source":"CNA: Go","vendor":"golang.org/x/net","versions":[{"lessThan":"0.62.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-78661","cwes":["CWE-407"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","epss":{"date":"2026-11-04","percentile":0.08136,"score":0.00185},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793812657673,"publishedAt":1793137136517,"references":[{"source":"CNA: Go","tags":[],"url":"https://go.dev/cl/849365"},{"source":"CNA: Go","tags":[],"url":"https://go.dev/issue/82224"},{"source":"CNA: Go","tags":[],"url":"https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"},{"source":"CNA: Go","tags":[],"url":"https://pkg.go.dev/vuln/GO-2026-6860"},{"source":"security@golang.org","tags":[],"url":"https://go.dev/cl/849365"},{"source":"security@golang.org","tags":[],"url":"https://go.dev/issue/82224"},{"source":"security@golang.org","tags":[],"url":"https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"},{"source":"security@golang.org","tags":[],"url":"https://pkg.go.dev/vuln/GO-2026-6860"}],"remediation":[],"revision":"bd9c9d6c9f5a7ccbf62693d0165ebd8be27b08fba1e219733a8d11d5486c8a50","sources":[{"modifiedAt":1793810430972,"name":"CNA: Go","retrievedAt":1793812215918,"url":"https://www.cve.org/CVERecord?id=CVE-2026-78661"},{"modifiedAt":1793812657673,"name":"NVD","retrievedAt":1793816565563,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793812221492,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78661"}],"ssvc":{"assessedAt":1793810403476,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net","updatedAt":1793816565563}