CVE-2026-78661

— UNSCORED

Published 2026-10-27 · Updated 2026-10-27

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

All references

https://go.dev/cl/849365
https://go.dev/issue/82224
https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs
https://pkg.go.dev/vuln/GO-2026-6860

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.