The golang.org/x/net/html package contains an inefficient algorithmic complexity vulnerability (CWE-407) that allows specially crafted HTML input to cause excessive CPU usage during parsing. This can result in denial of service conditions by degrading system performance or causing service unavailability. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

Successful exploitation can cause denial of service through excessive CPU consumption when parsing malicious HTML content. There is no impact on confidentiality or integrity. The vulnerability could degrade or disrupt services relying on the affected package.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure to untrusted HTML inputs or applying input validation to reduce risk.