{"schema":"threatline.record/2","record":{"id":"CVE-2026-78661","aliases":[],"summary":"Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net","details":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","categories":["Unclassified"],"product":"golang.org/x/net/html","vendor":"golang.org/x/net","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78661","source_modified_at":"2026-10-27T21:38:56.517Z","fetched_at":"2026-10-28T01:10:53.534015Z","product":"golang.org/x/net/html","vendor":"golang.org/x/net","versions":[{"version":"0","lessThan":"0.62.0","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78661","source_modified_at":"2026-10-27T21:38:56.517Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"name":"golang.org/x/net/html","ecosystem":null},"version":"0.62.0","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T21:38:56.517Z","modified_at":"2026-10-27T21:38:56.517Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-78661","fetched_at":"2026-10-28T01:10:53.534015Z","source_modified_at":"2026-10-27T21:38:56.517Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://go.dev/cl/849365"},{"source":"CVE List","url":"https://go.dev/issue/82224"},{"source":"CVE List","url":"https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"},{"source":"CVE List","url":"https://pkg.go.dev/vuln/GO-2026-6860"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T21:38:56.517Z","content_hash":"e65394fa8fe3fcc1cd2ade9e066a95d837e8cf52a2500cc08c73ac0c4ef9535e"}}