AIKIDO-2026-11037

golang.org/x/net is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)CVE-2026-25680 Published Jun 2, 2026

Medium Risk

This Affects:

golang.org/x/net

0.0.0 - 0.54.0

Fixed in 0.55.0

Are you affected? Scan for Free

TL;DR

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and if you use the golang.org/x/net/html functionalities.

Background info

golang.org/x/net is vulnerable to Denial of Service (DoS) in versions 0.0.0 - 0.54.0.

How to fix this

Upgrade the golang.org/x/net library to the patch version.

Medium Risk

This Affects:

golang.org/x/net

0.0.0 - 0.54.0

Fixed in 0.55.0

Are you affected? Scan for Free

Links

pkg.go.dev/vuln/GO-2026-5028

go.dev/cl/781702

go.dev/issue/79573

groups.google.com/g/golang-announce/c/iI-mYSI0lu8

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Scan for Free

Book a Demo

Free. No credit card required.

Company

Resources

Industries

Use Cases

Compare

Legal

Connect

hello@aikido.dev

Security

Stay up to date with all updates

I consent to receiving marketing communications based on Aikido’s Privacy Policy.

LinkedIn YouTube X

Keizer Karelstraat 15, 9000, Ghent, Belgium

95 Third St, 2nd Fl, San Francisco, CA 94103, US

Unit 6.15 Runway East 18 18 Crucifix Ln, London SE1 3JW UK

Ghent, Belgium | San Francisco, US