Text Node Coalescing O(n^2) Allocation in Go HTML Parser

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: Go Project

Description

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-78661

EUVD

EUVD-2026-111399

Affected Vendors & Products

Vendor	Product	Version / Range
golang.org/x/net	golang.org/x/net/html	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves inefficient string handling during HTML parsing in Go's x/net/html library. When processing text nodes, the code repeatedly reallocates and copies strings for each small text segment, leading to quadratic time complexity (O(n^2)) for inputs with many short text runs separated by ignored tags.

Impact Analysis

This vulnerability can cause performance degradation or denial-of-service conditions when parsing large or complex HTML documents with many short text segments. It may slow down applications processing such inputs or consume excessive CPU and memory resources.

Hi! I’m here to help you understand CVE-2026-78661. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70