Golang.org/x/net
20 CVEs across 8 Golang.org/x/net products. Browse Golang.org/x/net vulnerabilities, severities, and proof-of-concept exploits.
Golang.org/x/net products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46600 | High | 7.5 | 2026-07-21 | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. |
CVE-2026-42506 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |
CVE-2026-42502 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |
CVE-2026-39821 | Critical | 9.6 | 2026-05-22 | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") i… |
CVE-2026-27136 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |
CVE-2026-25681 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |
CVE-2026-25680 | Medium | 6.5 | 2026-05-22 | Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. |
CVE-2026-33814 | High | 7.5 | 2026-05-07 | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a va… |
CVE-2026-27141 | High | 7.5 | 2026-02-26 | Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic |
CVE-2025-58190 | Medium | 5.3 | 2026-02-05 | The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an a… |
CVE-2025-47911 | Medium | 5.3 | 2026-02-05 | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if… |
CVE-2025-22872 | Medium | 6.5 | 2025-04-16 | The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer… |
CVE-2025-22870 | Medium | 4.4 | 2025-03-12 | Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is s… |
CVE-2024-45338 | Medium | 5.3 | 2024-12-18 | An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. Thi… |
CVE-2023-45288 | High | 7.5 | 2024-04-04 | An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK stat… |
CVE-2023-39325 | High | 7.5 | 2023-10-11 | A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of… |
CVE-2023-3978 | Medium | 6.1 | 2023-08-02 | Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. |
CVE-2022-41723 | High | 7.5 | 2023-02-28 | A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of… |
CVE-2022-41721 | High | 7.5 | 2023-01-13 | A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the serv… |
CVE-2022-41717 | Medium | 5.3 | 2022-12-08 | An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by t… |