Infinite loop in Go Net - CVE-2025-58190

Vulnerability identifier: #VU124084

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-58190

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the html.Parse function when processing specially crafted HTML content. A remote attacker can pass malicious input to the application and cause a denial of service.

Go Net
SUSE Linux Enterprise Server 15
SUSE Linux Micro
HPC Module
openSUSE Leap
Ubuntu
Splunk Enterprise
golang-golang-x-net-dev (Ubuntu package)
golang-golang-x-net (Ubuntu package)
adsys (Ubuntu package)
apptainer
apptainer-debuginfo
apptainer-leap
apptainer-sle15_6
apptainer-sle15_7
apptainer-sle16
elemental-support
elemental-register
elemental-toolkit

Install updates from vendor's website.

Go Net - update to 0.45.0
Splunk Enterprise - addressed in versions 9.3.12, 9.4.11, 10.0.6, 10.2.3
golang-golang-x-net-dev (Ubuntu package) - addressed in versions 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2, 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2, 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2
golang-golang-x-net (Ubuntu package) - addressed in versions 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2, 1:0.21.0+dfsg-1ubuntu0.1~esm2
adsys (Ubuntu package) - addressed in versions 0.9.2~20.04.2ubuntu0.1+esm1, 2.0.11-0ubuntu1~16.04.4+esm2, 2.3.7-0ubuntu0.16.04.1+esm2, 3.0.3-0ubuntu1~18.04.2+esm2
apptainer - update to 1.4.5-150600.4.15.1
apptainer-debuginfo - update to 1.4.5-150600.4.15.1
apptainer-leap - update to 1.4.5-150600.4.15.1
apptainer-sle15_6 - update to 1.4.5-150600.4.15.1
apptainer-sle15_7 - update to 1.4.5-150600.4.15.1
apptainer-sle16 - update to 1.4.5-150600.4.15.1
elemental-support - update to 1.8.1-160000.1.1
elemental-register - update to 1.8.1-160000.1.1
elemental-toolkit - update to 2.3.2-160000.1.1

• https://github.com/golang/vulndb/issues/4441
• https://go.dev/cl/709875
• https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c
• https://pkg.go.dev/vuln/GO-2026-4441

• Denial of service in Go Net
• SUSE update for elemental-register, elemental-toolkit
• SUSE update for apptainer
• Ubuntu update for golang-golang-x-net
• Ubuntu update for golang-golang-x-net-dev
• Ubuntu update for adsys
• Splunk Enterprise update for third-party components (May 2026)