CVE-2025-47911: 
cAdvisor vulnerability analysis and mitigation

CVE-2025-47911 is a quadratic parsing complexity vulnerability in the html.Parse function of the golang.org/x/net/html Go package. When processing specially crafted HTML content, the parser exhibits O(n²) algorithmic complexity, which can cause excessive CPU consumption and lead to denial of service (DoS). All versions of golang.org/x/net/html prior to 0.45.0 are affected. The vulnerability was published on February 5, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Go Vuln DB).

The root cause is classified as CWE-407 (Inefficient Algorithmic Complexity): the html.Parse function in golang.org/x/net/html does not bound its computational complexity for certain malformed or adversarial HTML inputs, resulting in quadratic time growth relative to input size. An unauthenticated, remote attacker can exploit this by submitting crafted HTML content to any application that passes untrusted input to html.Parse, triggering excessive CPU usage without requiring any privileges or user interaction. The fix was implemented via Go code review CL 709876 and is tracked in the Go vulnerability database as GO-2026-4440 (GitHub Advisory, Go CL, Go Vuln DB).

Successful exploitation causes excessive CPU consumption in the affected application, potentially rendering it unresponsive or unavailable to legitimate users — a classic availability-only DoS impact. There is no confidentiality or integrity impact, as the vulnerability does not enable data access or modification. The scope of impact is limited to the affected component, but any application or service built on golang.org/x/net/html (including downstream products such as IBM Db2 on Cloud Pak for Data, IBM Cloud Pak for Business Automation, and various open-source tools like Helm, Gitea, and Grafana) is potentially affected (GitHub Advisory, IBM Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). No threat actor attribution has been reported. The EPSS score is approximately 0.02–0.033%, indicating a very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys and Tenable Nessus for identifying vulnerable deployments.

1. Identify target: Locate an internet-facing application or service that uses golang.org/x/net/html versions prior to 0.45.0 to parse user-supplied or externally sourced HTML content (e.g., web scrapers, HTML sanitizers, content management systems, or API endpoints accepting HTML input).
2. Craft malicious HTML: Construct a specially crafted HTML document designed to trigger worst-case quadratic parsing behavior in html.Parse. This typically involves deeply nested or repetitively structured HTML elements that cause the parser to perform O(n²) operations.
3. Submit payload: Send the crafted HTML content to the target application via an HTTP request, file upload, API call, or any other input channel that feeds data into html.Parse.
4. Trigger DoS: The parser consumes excessive CPU resources processing the input, causing the application to become slow or unresponsive, effectively denying service to legitimate users (GitHub Advisory, Go Vuln DB).

• Process: Sustained high CPU utilization by Go-based application processes, particularly during or after HTML parsing operations; application threads or goroutines stuck in HTML parsing routines for abnormally long durations.
• Logs: Application logs showing unusually long request processing times or timeouts for endpoints that accept or process HTML input; repeated slow or failed responses correlated with specific HTML payloads.
• Network: Repeated HTTP requests containing large or structurally unusual HTML bodies submitted to endpoints that invoke html.Parse; requests with deeply nested or repetitive HTML tag structures.

The vulnerability is fixed in golang.org/x/net/html version 0.45.0 and later; upgrading to this version is the primary recommended remediation (GitHub Advisory, Go CL). For applications that cannot be immediately updated, implement input validation and size restrictions on HTML content before passing it to html.Parse, and consider rate limiting on endpoints that process HTML. IBM has released patches for affected products including Db2 on Cloud Pak for Data and IBM Cloud Pak for Business Automation (IBM Advisory, IBM Advisory). Downstream consumers of golang.org/x/net (e.g., Helm, Gitea, Grafana Alloy, Apptainer) should update to versions that bundle the patched library.

The Go security team disclosed the vulnerability via the golang-announce mailing list and published a fix through the standard Go vulnerability database process (golang-announce). Multiple Linux distributions including openSUSE, Ubuntu, and Amazon Linux have issued security advisories and updated packages for affected Go-based software. IBM published security bulletins for several enterprise products affected by this dependency. Community reaction has been routine for a medium-severity DoS issue, with no notable controversy or significant social media discussion observed.