Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Azure yq 4.45.1-1 may hang when parsing malicious HTML
published 9 months ago
Summary
The yq tool version 4.45.1-1 can get stuck in an endless loop when it processes specially crafted HTML content. This can cause the program to stop responding, potentially interrupting services that rely on it. Update to a newer version of yq or avoid feeding untrusted HTML into the tool to prevent the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | yq | <= 4.45.1-1 |
Original advisory text
CVE-2025-58190 affecting package yq 4.45.1-1
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
References
Timeline
Published5 Feb 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-76811 · OSV
Track software like this
Free during beta