{"id":"DEBIAN-CVE-2026-78661","details":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\u003c/x\u003e\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","modified":"2026-10-29T09:47:35.528578294Z","published":"2026-10-27T22:18:05.930Z","upstream":["CVE-2026-78661"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-78661"}],"affected":[{"package":{"name":"golang-golang-x-net","ecosystem":"Debian:12","purl":"pkg:deb/debian/golang-golang-x-net?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.10.0-1","1:0.11.0-1","1:0.14.0-1","1:0.15.0-1","1:0.15.0-2","1:0.17.0+dfsg-1","1:0.19.0+dfsg-1","1:0.20.0+dfsg-1","1:0.21.0+dfsg-1","1:0.22.0+dfsg-1","1:0.23.0+dfsg-1","1:0.24.0+dfsg-1","1:0.25.0+dfsg-1","1:0.26.0+dfsg-1","1:0.26.0+dfsg-2","1:0.27.0-1","1:0.27.0-2","1:0.47.0-1","1:0.47.0-2","1:0.53.0-1","1:0.53.0-2","1:0.53.0-2~bpo13+1","1:0.55.0-1","1:0.56.0-1","1:0.57.0-1","1:0.58.0-1","1:0.60.0-1","1:0.61.0-1","1:0.7.0+dfsg-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-78661.json"}},{"package":{"name":"golang-golang-x-net","ecosystem":"Debian:13","purl":"pkg:deb/debian/golang-golang-x-net?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.27.0-2","1:0.47.0-1","1:0.47.0-2","1:0.53.0-1","1:0.53.0-2","1:0.53.0-2~bpo13+1","1:0.55.0-1","1:0.56.0-1","1:0.57.0-1","1:0.58.0-1","1:0.60.0-1","1:0.61.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-78661.json"}},{"package":{"name":"golang-golang-x-net","ecosystem":"Debian:14","purl":"pkg:deb/debian/golang-golang-x-net?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.27.0-2","1:0.47.0-1","1:0.47.0-2","1:0.53.0-1","1:0.53.0-2","1:0.53.0-2~bpo13+1","1:0.55.0-1","1:0.56.0-1","1:0.57.0-1","1:0.58.0-1","1:0.60.0-1","1:0.61.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-78661.json"}}],"schema_version":"1.9.2"}