Vulnerability Description
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
CVSS Score
5.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go | Html | < 0.45.0 |
Related Weaknesses (CWE)
References
- https://github.com/golang/vulndb/issues/4441ExploitIssue Tracking
- https://go.dev/cl/709875Patch
- https://groups.google.com/g/golang-announce/c/jnQcOYpiR2cMailing ListThird Party Advisory
- https://pkg.go.dev/vuln/GO-2026-4441Vendor Advisory
FAQ
What is CVE-2025-58190?
CVE-2025-58190 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML c...
How severe is CVE-2025-58190?
CVE-2025-58190 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-58190?
Check the references section above for vendor advisories and patch information. Affected products include: Go Html.