Parsing arbitrary HTML with golang.org/x/net/html can cause excessive CPU consumption, leading to a denial of service. The vulnerability is a resource exhaustion flaw and can be exploited by feeding specially crafted HTML that forces the parser to spend large amounts of time processing nested structures. The attack compromises availability while posing no threat to confidentiality or integrity.

The flaw affects the Go networking library golang.org/x/net/html. No specific version range is listed, so any installation that relies on this package may be vulnerable unless a newer, fixed release is used. The library is typically embedded in Go applications that handle HTML content.

The CVSS score is 6.5, indicating a moderate severity. The EPSS value is not available and the vulnerability is not listed in CISA KEV. The vulnerability can be exploited by sending malicious HTML to any process that parses it, making it potentially usable by remote attackers if the application exposes such parsing functionality. Because the attack is a simple CPU‑time exhaustion, it requires only the ability to supply input; no additional privileges are needed. Defenses such as limiting input size, imposing timeouts, or performing preprocessing can mitigate the risk.