CVE-2026-25680 — Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

Affected: golang.org/x/net/html

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

GHSA-gcjh-h69q-9w9g — cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

Affected: Go: github.com/google/cel-go

The function `ext.NativeTypes(ParseStructTag("json"))` does not honour the `encoding/json` skip directive `json:"-"`. Fields tagged `json:"-"` are registered in the CEL type system under the literal name `"-"` and are readable from any user-submitted CEL expression via `dyn(obj)["-"]`.

Additionally, `newNativeTypes` silently registers every nested struct reachable from the type passed to `NativeTypes`, including types from third-party dependencies the developer never examined.

## Root cause

In `fieldNameByTag`, the helper used by `ParseStructTag("json")` to translate Go struct tags into CEL field names.

See at `ext/native.go:146`:

```go func fieldNameByTag(structTagToParse string) func(field reflect.StructField) string { return func(field reflect.StructField) string { tag, found := field.Tag.Lookup(structTagToParse) if found { splits := strings.Split(tag, ",") if len(splits) > 0 { // We make the assumption that the leftmost entry in the tag is the name. // This seems to be true for most tags that have the concept of a name/key, such as: // https://pkg.go.dev/encoding/xml#Marshal // https://pkg.go.dev/encoding/json#Marshal // https://pkg.go.dev/go.mongodb.org/mongo-driver/bson#hdr-Structs // https://pkg.go.dev/go.yaml.in/yaml/v3#Marshal name := splits[0] return name } }

re…

Most recent entries from all

CVE-2026-25680 — Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

GHSA-gcjh-h69q-9w9g — cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag