The vulnerability resides in golang.org/x/net's HTML parsing package. When the parser merges adjacent text nodes, it appends to existing TextNode data with repeated string concatenation (n.Data += text). On each token this reallocates and copies the entire accumulated string, resulting in quadratic time and space consumption. Crafting input with many short text fragments separated by ignored end tags triggers O(n²) allocations and copies, leading to excessive CPU and memory usage.

Any Go program that imports golang.org/x/net/html for parsing or rendering HTML may be impacted. The CVE does not specify a particular version; therefore, all releases containing the unpatched logic are susceptible.

The lack of published CVSS or EPSS scores and absence from CISA KEV indicate no known exploit details; however, the quadratic processing can be exploited by feeding large amounts of text. Exfiltration requires the attacker to provide input to the parser, which might be possible remotely if the application accepts user‑controlled HTML, or locally via scripts. It is inferred that supplying such input could overwhelm the parser, resulting in service degradation or crash. The risk is considered high due to the potential for resource exhaustion.