CVE-2026-78661

What it actually does

Repeated string concatenation during adjacent text node coalescing in addText and fosterParent triggers O(n^2) allocations and byte copies for inputs containing many short text runs separated by ignored end tags.

Why it matters to the business

Unpatched parsers can be forced into excessive memory and CPU consumption by specially crafted input, leading to service slowdowns or outages with minimal attacker effort; the issue is two days old with stable low exploit probability and no known ransomware use.

How an attack unfolds

An attacker supplies a document with numerous short text segments interleaved with ignored end tags, causing the parser to repeatedly reallocate and copy accumulating text data on every token until resource exhaustion occurs.

How to fix it

Update to a version that accumulates coalesced text in per-node byte slices and materializes Data strings only once at the end of parsing; monitor vendor advisories for the exact fixed release once published.

How to confirm the fix worked

Review parser source for replacement of n.Data += text concatenation with byte-slice accumulation; test with inputs containing many short text runs separated by ignored end tags and confirm allocation count remains linear.

Typical attack path

1. Identify a service that accepts and parses untrusted markup using the vulnerable coalescing logic.
2. Craft input containing many short text runs separated by ignored end tags such as a</x>.
3. Submit the payload to trigger repeated string reallocations during node coalescing.
4. Observe quadratic growth in allocations leading to high memory or CPU usage and potential denial of service.

How to detect it

Monitor for parsing operations that consume disproportionate CPU or memory; review application logs for repeated processing of documents with many short text segments and ignored end tags.

What your security team should do

• Prioritize patching the affected parser library within standard change windows given the two-day publication window and absence of known exploitation.
• Implement input size or structural limits on parsed documents as a temporary control until patches are available.
• Add monitoring for unusual memory or CPU spikes during parsing operations.