CVE-2025-58190: 
cAdvisor vulnerability analysis and mitigation

CVE-2025-58190 is an infinite parsing loop vulnerability in the html.Parse function of the golang.org/x/net/html Go package that can lead to denial of service (DoS). It affects all versions of golang.org/x/net/html prior to 0.45.0. The vulnerability was disclosed on February 5, 2026, and is classified as CWE-835 (Loop with Unreachable Exit Condition). It carries a CVSS v3.1 base score of 5.3 (Medium) (Go Vuln DB, IBM Advisory).

The root cause is CWE-835 — a loop with an unreachable exit condition — within the html.Parse function of golang.org/x/net/html. When the parser encounters certain specially crafted HTML inputs, it enters an infinite loop from which it cannot exit, consuming CPU resources indefinitely. The vulnerability requires no authentication or user interaction and is exploitable remotely over the network with low attack complexity. The issue was tracked in the Go vulnerability database as GO-2026-4441 and is linked to the upstream Go issue golang/go#70179 (Go Vuln DB, GitHub Issue).

Successful exploitation causes the affected application to enter an infinite CPU-consuming loop, rendering it unresponsive and resulting in a denial of service condition. There is no confidentiality or integrity impact — only availability is affected. Any application or service that uses golang.org/x/net/html to parse untrusted or user-supplied HTML content is at risk, including downstream products such as IBM Db2 on Cloud Pak for Data, IBM Db2 Warehouse on Cloud Pak for Data, Veeam products, Splunk, and various SUSE/openSUSE packages (IBM Advisory, Go Vuln DB).

A proof-of-concept reference exists in the Go vulnerability database issue tracker, but there is no evidence of active in-the-wild exploitation at this time (GitHub Issue). The vulnerability requires no privileges and no user interaction, making it trivially exploitable by any network-accessible attacker who can supply HTML input to a vulnerable application. The EPSS score is approximately 0.02% (0.000200), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify a target: Locate a publicly accessible application or service built with Go that uses golang.org/x/net/html (versions < 0.45.0) to parse HTML input — such as web scrapers, HTML sanitizers, or content processing services.
2. Craft malicious HTML: Construct a specially crafted HTML document that triggers the infinite parsing loop in html.Parse. The specific input pattern exploits a parser state from which no exit condition is reachable (per golang/go#70179).
3. Submit the payload: Deliver the crafted HTML to the target application via any input channel that feeds into html.Parse — for example, an HTTP request body, a form field, or an API endpoint that accepts HTML content.
4. Trigger DoS: The parser enters an infinite loop, consuming 100% of a CPU core and causing the application to become unresponsive, effectively denying service to legitimate users (Go Vuln DB, GitHub Issue).

• Process: Go application process consuming 100% CPU for an extended, abnormal duration with no corresponding legitimate workload.
• Logs: Application logs showing a request that initiated HTML parsing but never completed or returned a response; timeout errors or watchdog alerts triggered by hung goroutines.
• Network: Repeated HTTP requests to endpoints that accept HTML input from the same source IP, particularly with unusual or malformed HTML payloads.
• Application Behavior: Service becomes unresponsive or health checks begin failing shortly after receiving a specific request containing crafted HTML content.

The vulnerability is fixed in golang.org/x/net/html version 0.45.0 and later. Developers should update their Go module dependency by running go get golang.org/x/net@v0.45.0 and rebuilding affected applications. Downstream product vendors have released or are releasing patches: IBM has addressed this in Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data, Ubuntu issued USN-8089-1/2/3, and SUSE/openSUSE have released corresponding security updates. As a temporary workaround, applications can implement input size limits or timeouts on HTML parsing operations to bound the impact of an infinite loop (Go Patch, Go Vuln DB, IBM Advisory).

The vulnerability has received broad attention from Linux distribution maintainers, with SUSE, openSUSE, Ubuntu, and Amazon Linux all issuing security advisories and package updates. Veeam and Splunk have also published advisories acknowledging the impact on their products. Community reaction has been measured given the Medium severity rating and lack of active exploitation, with the primary focus on patching downstream Go-based software that processes untrusted HTML (IBM Advisory, Ubuntu USN-8089-1).