diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go
index dd4c53a80d..d5c258ecaa 100644
--- a/src/html/template/escape_test.go
+++ b/src/html/template/escape_test.go
@@ -656,6 +656,11 @@ func TestEscape(t *testing.T) {
 			// The second URL is also filtered.
 			`<img srcset="/not-an-image#,#ZgotmplZ">`,
 		},
+		{
+			"srcset buffer growth",
+			`<img srcset={{",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"}}>`,
+			`<img srcset=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,>`,
+		},
 	}
 
 	for _, test := range tests {
diff --git a/src/html/template/url.go b/src/html/template/url.go
index a5c775c94e..f0516300de 100644
--- a/src/html/template/url.go
+++ b/src/html/template/url.go
@@ -88,7 +88,7 @@ func urlProcessor(norm bool, args ...interface{}) string {
 // processURLOnto appends a normalized URL corresponding to its input to b
 // and returns true if the appended content differs from s.
 func processURLOnto(s string, norm bool, b *bytes.Buffer) bool {
-	b.Grow(b.Cap() + len(s) + 16)
+	b.Grow(len(s) + 16)
 	written := 0
 	// The byte loop below assumes that all URLs use UTF-8 as the
 	// content-encoding. This is similar to the URI to IRI encoding scheme