golang.org/x/net v0.62.0 fixes HTML text-node complexity flaw
Original title: Vulnerabilities in golang.org/x/net
The html package change targets quadratic work while coalescing adjacent text nodes in addText.
The Go project tagged golang.org/x/net v0.62.0 to fix security issues, according to a notice forwarded on oss-security. The visible issue is in the html package, which could take quadratic time when coalescing adjacent text nodes. The forwarded message is cut off, so the full set of fixes is not shown.
Unconfirmed: The notice is truncated, so other issues and affected version ranges are not shown.
- The fixed module version named in the notice is v0.62.0.
- The described flaw is in html text-node coalescing.
- Alan Coopersmith forwarded the October 27 golang-announce message.
Impact: Quadratic complexity when coalescing adjacent HTML text nodes
| Product | Affected | Fixed in |
|---|---|---|
| golang.org/x/net | — | v0.62.0 |
- 1.Upgrade golang.org/x/net to v0.62.0
- Vendors
- Go
- Products
- golang.org/x/net
From the original article
Posted by Alan Coopersmith on Oct 27 -------- Forwarded Message -------- Subject: [security] Vulnerabilities in golang. org/x/net Date: Tue, 27 Oct 2026 19:53:49 +0000 From: announce () golang org To: golang-nuts () googlegroups com Hello gophers, We have tagged version v0. 62.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.