Golang Net
12 CVEs affecting Golang Net. Latest disclosed: 2026-05-22. Critical: 1, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39821 | Critical | 9.6 | 2026-05-22 | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") i… |
CVE-2018-17848 | High | 7.5 | 2018-10-01 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of ran… |
CVE-2018-17847 | High | 7.5 | 2018-10-01 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out… |
CVE-2018-17846 | High | 7.5 | 2018-10-01 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Par… |
CVE-2018-17143 | High | 7.5 | 2018-09-17 | The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in p… |
CVE-2018-17142 | High | 7.5 | 2018-09-17 | The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken… |
CVE-2018-17075 | High | 7.5 | 2018-09-16 | The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <templ… |
CVE-2026-25680 | Medium | 6.5 | 2026-05-22 | Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. |
CVE-2026-42506 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |
CVE-2026-42502 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |
CVE-2026-27136 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |
CVE-2026-25681 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |