{"id":"EUVD-2026-111399","enisaUuid":"3962d2d7-4d96-36b9-a5d5-3414a94005bf","description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode\u0027s Data via string concatenation (n.Data +\u003d text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\u003c/x\u003e\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","datePublished":"Oct 27, 2026, 9:38:56 PM","dateUpdated":"Oct 27, 2026, 9:38:56 PM","baseScore":0.0,"references":"https://go.dev/cl/849365\nhttps://go.dev/issue/82224\nhttps://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs\nhttps://pkg.go.dev/vuln/GO-2026-6860\n","aliases":"CVE-2026-78661\nGHSA-75pg-wvh3-34jr\n","assigner":"Go","epss":0.0,"enisaIdProduct":[{"id":"9427dca5-d996-3107-9fa7-a6e86514d5c3","product":{"name":"golang.org/x/net/html","vendor":{"name":"golang.org/x/net"}},"product_version":"0 \u003c0.62.0"}],"enisaIdVendor":[{"id":"0ac86d54-28a6-3f58-875b-a349c790ad27","vendor":{"name":"golang.org/x/net"}}],"enisaIdVulnerability":[{"id":"080d5e25-71b1-36de-b415-9eb351449a82","vulnerability":{"id":"GHSA-75pg-wvh3-34jr","description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode\u0027s Data via string concatenation (n.Data +\u003d text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\u003c/x\u003e\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","datePublished":"Oct 28, 2026, 12:30:30 AM","dateUpdated":"Oct 28, 2026, 12:30:30 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661\nhttps://go.dev/cl/849365\nhttps://go.dev/issue/82224\nhttps://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs\nhttps://pkg.go.dev/vuln/GO-2026-6860\n","enisa_id":"EUVD-2026-111399\n","aliases":"CVE-2026-78661\nGHSA-75pg-wvh3-34jr\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 11:01:09 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"76ba4fe6-bc19-37df-99d9-4bb3739edfd8","vulnerability":{"id":"CVE-2026-78661","description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode\u0027s Data via string concatenation (n.Data +\u003d text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\u003c/x\u003e\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","datePublished":"Oct 27, 2026, 9:38:56 PM","dateUpdated":"Oct 27, 2026, 9:38:56 PM","status":"PUBLISHED","baseScore":0.0,"references":"https://go.dev/cl/849365\nhttps://go.dev/issue/82224\nhttps://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs\nhttps://pkg.go.dev/vuln/GO-2026-6860\n","enisa_id":"EUVD-2026-111399\n","assigner":"Go","epss":0.0,"dataProcessed":"Oct 28, 2026, 11:00:41 AM","vulnerabilityProduct":[{"id":"a37ba9a7-b17f-3a32-9d47-ff4e03d89bb4","product":{"name":"golang.org/x/net/html","vendor":{"name":"golang.org/x/net"}},"product_version":"0 \u003c0.62.0"}],"vulnerabilityVendor":[{"id":"e3375c1d-a938-35fe-97e3-52ad2da72791","vendor":{"name":"golang.org/x/net"}}]}}],"enisaIdAdvisory":[]}