CVE-2025-58190
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Feb 5, 2026
CISA due date
—
The record
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | golang.org/x/net | 0 | 0.45.0 |
| Chainguard | addon-resizer | 0 | 0 |
| Chainguard | addon-resizer-fips | 0 | 0 |
| Chainguard | amazon-ecs-agent | 0 | 0 |
| Chainguard | amazon-ecs-agent-fips | 0 | 0 |
| Chainguard | amazon-k8s-cni-init-fips-compat | 0 | 0 |
| Chainguard | ansible-operator | 0 | 0 |
| Chainguard | ansible-operator-fips | 0 | 0 |
| Chainguard | apm-server-9.0 | 0 | 0 |
| Chainguard | apm-server-fips-8.18 | 0 | 0 |
| Chainguard | apm-server-fips-9.0 | 0 | 0 |
| Chainguard | argo-cd-fips-2.13 | 0 | 0 |
| Chainguard | argo-cd-fips-2.13-compat | 0 | 0 |
| Chainguard | auditbeat-fips-8.17 | 0 | 0 |
| Chainguard | auditbeat-fips-8.18 | 0 | 0 |
| Chainguard | auditbeat-fips-9.0 | 0 | 0 |
| Chainguard | aws-application-networking-k8s | 0 | 0 |
| Chainguard | aws-application-networking-k8s-fips | 0 | 0 |
| Chainguard | aws-ebs-csi-driver-1.50 | 0 | 0 |
| Chainguard | aws-ebs-csi-driver-fips-1.50 | 0 | 0 |
| Chainguard | aws-efs-csi-driver | 0 | 0 |
| Chainguard | aws-efs-csi-driver-fips | 0 | 0 |
| Chainguard | aws-load-balancer-controller | 0 | 3.1.0-r1 |
| Chainguard | aws-load-balancer-controller-fips | 0 | 0 |
| Chainguard | aws-s3-controller | 0 | 0 |
| Chainguard | cass-operator | 0 | 0 |
| Chainguard | cass-operator-fips | 0 | 0 |
| Chainguard | cass-operator-fips-no-pvc-delete | 0 | 0 |
| Chainguard | cilium-envoy-1.17 | 0 | 1.17.13-r0 |
| Chainguard | cilium-envoy-fips-1.17 | 0 | 1.17.13-r0 |
| Chainguard | cilium-fips-1.15 | 0 | 0 |
| Chainguard | cilium-fips-1.15-clustermesh-apiserver | 0 | 0 |
| Chainguard | cilium-fips-1.15-host-utils | 0 | 0 |
| Chainguard | cilium-fips-1.15-hubble-relay | 0 | 0 |
| Chainguard | cilium-fips-1.15-operator-aws | 0 | 0 |
| Chainguard | cilium-fips-1.15-operator-azure | 0 | 0 |
| Chainguard | cilium-fips-1.15-operator-generic | 0 | 0 |
| Chainguard | cis-operator-1.2 | 0 | 0 |
| Chainguard | cis-operator-1.3 | 0 | 0 |
| Chainguard | cloud-provider-aws-1.28-cloud-controller-manager | 0 | 0 |
| Chainguard | cloud-provider-aws-1.28-ecr-credential-provider | 0 | 0 |
| Chainguard | cloud-provider-aws-1.31-cloud-controller-manager | 0 | 0 |
| Chainguard | cloud-provider-aws-1.31-ecr-credential-provider | 0 | 0 |
| Chainguard | cloud-provider-aws-fips-1.28-cloud-controller-manager | 0 | 0 |
| Chainguard | cloud-provider-aws-fips-1.28-ecr-credential-provider | 0 | 0 |
| Chainguard | cluster-api-ipam-provider-in-cluster | 0 | 0 |
| Chainguard | cluster-proportional-autoscaler | 0 | 0 |
| Chainguard | cluster-proportional-autoscaler-fips | 0 | 0 |
| Chainguard | cni-plugins | 0 | 0 |
| Chainguard | cni-plugins-aws-k8s-compat | 0 | 0 |
| Chainguard | cni-plugins-dhcp | 0 | 0 |
| Chainguard | cni-plugins-fips | 0 | 0 |
| Chainguard | cni-plugins-fips-dhcp | 0 | 0 |
| Chainguard | cni-plugins-fips-ipam | 0 | 0 |
| Chainguard | cni-plugins-ipam | 0 | 0 |
| Chainguard | consul-k8s-1.1 | 0 | 0 |
| Chainguard | consul-k8s-1.3 | 0 | 0 |
| Chainguard | consul-k8s-1.4 | 0 | 0 |
| Chainguard | consul-k8s-1.5 | 0 | 0 |
| Chainguard | consul-k8s-1.6 | 0 | 0 |
| Chainguard | consul-k8s-1.7 | 0 | 0 |
| Chainguard | consul-k8s-1.9 | 0 | 0 |
| Chainguard | consul-k8s-fips-1.1 | 0 | 0 |
| Chainguard | consul-k8s-fips-1.3 | 0 | 0 |
| Chainguard | consul-k8s-fips-1.3-cli | 0 | 0 |
| Chainguard | consul-k8s-fips-1.4 | 0 | 0 |
| Chainguard | consul-k8s-fips-1.5 | 0 | 0 |
| Chainguard | consul-k8s-fips-1.6 | 0 | 0 |
| Chainguard | container-object-storage-interface-controller | 0 | 0 |
| Chainguard | container-object-storage-interface-controller-fips | 0 | 0 |
| Chainguard | container-object-storage-interface-sidecar | 0 | 0 |
| Chainguard | container-object-storage-interface-sidecar-fips | 0 | 0 |
| Chainguard | contour-1.31 | 0 | 0 |
| Chainguard | contour-1.32 | 0 | 0 |
| Chainguard | contour-fips-1.31 | 0 | 0 |
| Chainguard | contour-fips-1.32 | 0 | 0 |
| Chainguard | crossplane-function-auto-ready | 0 | 0 |
| Chainguard | crossplane-function-auto-ready-fips | 0 | 0 |
| Chainguard | crossplane-function-environment-configs | 0 | 0 |
| Chainguard | crossplane-function-environment-configs-fips | 0 | 0 |
| Chainguard | custom-pod-autoscaler | 0 | 0 |
| Chainguard | custom-pod-autoscaler-fips | 0 | 0 |
| Chainguard | custom-pod-autoscaler-operator | 0 | 0 |
| Chainguard | custom-pod-autoscaler-operator-fips | 0 | 0 |
| Chainguard | cyberark-secrets-provider-for-k8s | 0 | 0 |
| Chainguard | cyberark-secrets-provider-for-k8s-fips | 0 | 0 |
| Chainguard | deck | 0 | 0 |
| Chainguard | deck-fips | 0 | 0 |
| Chainguard | dive | 0 | 0 |
| Chainguard | docker-machine-driver-harvester | 0 | 0 |
| Chainguard | doppler-kubernetes-operator | 0 | 0 |
| Chainguard | dragonfly-operator | 0 | 0 |
| Chainguard | dragonfly-operator-fips | 0 | 0 |
| Chainguard | eks-distro-kube-apiserver-1.34 | 0 | 0 |
| Chainguard | eks-distro-kube-apiserver-fips-1.34 | 0 | 0 |
| Chainguard | eks-distro-kube-controller-manager-1.34 | 0 | 0 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.34 | 0 | 0 |
| Chainguard | eks-distro-kube-proxy-1.34 | 0 | 0 |
| Chainguard | eks-distro-kube-proxy-fips-1.34 | 0 | 0 |
| Chainguard | eks-distro-kube-scheduler-1.34 | 0 | 0 |
| Chainguard | eks-distro-kube-scheduler-fips-1.34 | 0 | 0 |
| Chainguard | emissary | 0 | 0 |
| Chainguard | emissary-apiext | 0 | 0 |
| Chainguard | envoy-ratelimit | 0 | 0 |
| Chainguard | envoy-ratelimit-fips | 0 | 0 |
| Chainguard | falco-exporter | 0 | 0 |
| Chainguard | falco-exporter-fips | 0 | 0 |
| Chainguard | falcoctl-fips-0.4 | 0 | 0 |
| Chainguard | filebeat-fips-8.17 | 0 | 0 |
| Chainguard | filebeat-fips-8.18 | 0 | 0 |
| Chainguard | filebeat-fips-9.0 | 0 | 0 |
| Chainguard | fleet-server-8.17 | 0 | 0 |
| Chainguard | fleet-server-8.18 | 0 | 0 |
| Chainguard | fleet-server-9.0 | 0 | 0 |
| Chainguard | fleet-server-fips-8.17 | 0 | 0 |
| Chainguard | fleet-server-fips-8.18 | 0 | 0 |
| Chainguard | fleet-server-fips-9.0 | 0 | 0 |
| Chainguard | fluxcd-kustomize-mutating-webhook | 0 | 0 |
| Chainguard | fluxcd-kustomize-mutating-webhook-fips | 0 | 0 |
| Chainguard | fuse-overlayfs-snapshotter | 0 | 2.1.7-r2 |
| Chainguard | gendesk | 0 | 1.0.10-r6 |
| Chainguard | github-mcp-server | 0 | 0 |
| Chainguard | gitlab-rails-ce-18.7 | 0 | 0 |
| Chainguard | gitlab-rails-ce-18.8 | 0 | 18.8.4-r1 |
| Chainguard | gitlab-workhorse-ce-18.7 | 0 | 0 |
| Chainguard | gitlab-workhorse-ce-18.8 | 0 | 0 |
| Chainguard | gitness | 0 | 3.3.0-r9 |
| Chainguard | gke-gcloud-auth-plugin | 0 | 0 |
| Chainguard | glow | 0 | 0 |
| Chainguard | go-licenses | 0 | 0 |
| Chainguard | gostatsd | 0 | 0 |
| Chainguard | gpu-feature-discovery | 0 | 0.18.2-r4 |
| Chainguard | gpu-feature-discovery-fips | 0 | 0 |
| Chainguard | gpu-operator-24.9 | 0 | 0 |
| Chainguard | gpu-operator-fips-24.9 | 0 | 0 |
| Chainguard | grafana-pyroscope-1.12 | 0 | 0 |
| Chainguard | grafana-pyroscope-1.13 | 0 | 0 |
| Chainguard | grpcurl | 0 | 0 |
| Chainguard | grpcurl-fips | 0 | 0 |
| Chainguard | harbor-scanner-trivy | 0 | 0 |
| Chainguard | harbor-scanner-trivy-fips | 0 | 0 |
| Chainguard | heartbeat-fips-8.17 | 0 | 0 |
| Chainguard | heartbeat-fips-8.18 | 0 | 0 |
| Chainguard | heartbeat-fips-9.0 | 0 | 0 |
| Chainguard | ip-masq-agent | 0 | 0 |
| Chainguard | jaeger-operator | 0 | 0 |
| Chainguard | jaeger-operator-fips | 0 | 0 |
| Chainguard | jitsucom-bulker-bulker | 0 | 0 |
| Chainguard | jitsucom-bulker-ingest | 0 | 0 |
| Chainguard | jitsucom-bulker-ingmgr | 0 | 0 |
| Chainguard | jitsucom-bulker-sidecar | 0 | 0 |
| Chainguard | jitsucom-bulker-syncctl | 0 | 0 |
| Chainguard | k3s-1.31 | 0 | 1.31.6.1-r10 |
| Chainguard | k3s-1.32 | 0 | 1.32.13.1-r2 |
| Chainguard | k3s-1.33 | 0 | 1.33.10.1-r0 |
| Chainguard | k3s-multicall-1.31 | 0 | 1.31.6.1-r10 |
| Chainguard | k3s-multicall-1.32 | 0 | 1.32.13.1-r2 |
| Chainguard | k3s-multicall-1.33 | 0 | 1.33.10.1-r0 |
| Chainguard | k3s-static-1.31 | 0 | 1.31.6.1-r10 |
| Chainguard | k3s-static-1.32 | 0 | 1.32.13.1-r4 |
| Chainguard | k3s-static-1.33 | 0 | 1.33.10.1-r0 |
| Chainguard | k8s-metacollector | 0 | 0 |
| Chainguard | k8s-metacollector-fips | 0 | 0 |
| Chainguard | k8sgpt-operator | 0 | 0 |
| Chainguard | k8ssandra-operator | 0 | 0 |
| Chainguard | k8ssandra-operator-fips | 0 | 0 |
| Chainguard | karpenter-0.33 | 0 | 0 |
| Chainguard | karpenter-0.34 | 0 | 0 |
| Chainguard | karpenter-0.35 | 0 | 0 |
| Chainguard | karpenter-0.36 | 0 | 0 |
| Chainguard | karpenter-0.37 | 0 | 0 |
| Chainguard | karpenter-1.0 | 0 | 0 |
| Chainguard | karpenter-1.1 | 0 | 0 |
| Chainguard | karpenter-1.2 | 0 | 0 |
| Chainguard | karpenter-1.3 | 0 | 0 |
| Chainguard | karpenter-1.4 | 0 | 0 |
| Chainguard | karpenter-1.5 | 0 | 0 |
| Chainguard | karpenter-1.6 | 0 | 0 |
| Chainguard | karpenter-1.7 | 0 | 0 |
| Chainguard | karpenter-1.8 | 0 | 0 |
| Chainguard | karpenter-fips-0.33 | 0 | 0 |
| Chainguard | karpenter-fips-0.34 | 0 | 0 |
| Chainguard | karpenter-fips-0.35 | 0 | 0 |
| Chainguard | karpenter-fips-0.36 | 0 | 0 |
| Chainguard | karpenter-fips-0.37 | 0 | 0 |
| Chainguard | karpenter-fips-1.0 | 0 | 0 |
| Chainguard | karpenter-fips-1.1 | 0 | 0 |
| Chainguard | karpenter-fips-1.2 | 0 | 0 |
| Chainguard | karpenter-fips-1.3 | 0 | 0 |
| Chainguard | karpenter-fips-1.4 | 0 | 0 |
| Chainguard | karpenter-fips-1.5 | 0 | 0 |
| Chainguard | karpenter-fips-1.6 | 0 | 0 |
| Chainguard | karpenter-fips-1.7 | 0 | 0 |
| Chainguard | karpenter-fips-1.8 | 0 | 0 |
| Chainguard | kiam | 0 | 0 |
| Chainguard | knative-operator-1.17 | 0 | 0 |
| Chainguard | knative-operator-1.17-webhook | 0 | 0 |
| Chainguard | knative-operator-1.18 | 0 | 0 |
| Chainguard | knative-operator-1.18-webhook | 0 | 0 |
| Chainguard | knative-operator-1.19 | 0 | 0 |
Related vulnerabilities
- CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to… Also affects golang.org/x/net
- CVE-2025-47911 The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when… Also affects golang.org/x/net
- CVE-2025-22870 Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a… Also affects golang.org/x/net
- CVE-2024-45338 An attacker can craft an input to the Parse functions that would be processed… Also affects golang.org/x/net
- CVE-2023-45288 An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by… Also affects golang.org/x/net
- CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because… Also affects golang.org/x/net
- CVE-2026-27142 Actions which insert URLs into the content attribute of HTML meta tags are not escaped. Also affects addon-resizer
- CVE-2026-27139 On Unix platforms, when listing the contents of a directory using File.ReadDir or… Also affects addon-resizer