CVE-2026-78661
CVE
Medium
False Positivex/net/html: Quadratic Complexity When Coalescing Text Nodes
This advisory does not affect KrakenD
KrakenD is an API gateway and does not use
golang.org/x/net/html to parse HTML
content from requests or responses. The vulnerable parsing code path is never invoked
during KrakenD operation. The dependency was upgraded as a precaution.Addressed through routine dependency maintenance in CE 3.0.3 and EE 3.0.3, 2.13.13.
Component
Go extended library (x/net/html)
Disclosed
Nov 2, 2026
Description
Go’s
golang.org/x/net/html parser appends adjacent text to an existing text node with
string concatenation, both in addText and when foster-parenting text inside tables.
Each append copies the accumulated string, so HTML made of many short text runs
separated by ignored end tags makes html.Parse take quadratic time and allocations.
An attacker who controls the parsed HTML can exhaust CPU and memory.