本ページは golang net に影響する公開済み CVE（NVD の CPE 経由で関連付け）を列挙します。各行に深刻度指標・概要・公開日が含まれます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2026-42506 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | [email protected] | 6.1 | 0.25% | 2026-05-22 | 2026-06-17 |
| CVE-2026-42502 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | [email protected] | 6.1 | 0.24% | 2026-05-22 | 2026-06-17 |
| CVE-2026-39821 | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to U | [email protected] | 9.6 | 0.48% | 2026-05-22 | 2026-07-10 |
| CVE-2026-27136 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | [email protected] | 6.1 | 0.24% | 2026-05-22 | 2026-06-17 |
| CVE-2026-25681 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | [email protected] | 6.1 | 0.24% | 2026-05-22 | 2026-06-17 |
| CVE-2026-25680 | Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. | [email protected] | 6.5 | 0.25% | 2026-05-22 | 2026-06-17 |
| CVE-2018-17848 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call. | [email protected] | 7.5 | 2.68% | 2018-10-01 | 2026-06-16 |
| CVE-2018-17847 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call. | [email protected] | 7.5 | 2.83% | 2018-10-01 | 2026-06-16 |
| CVE-2018-17846 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification. | [email protected] | 7.5 | 2.62% | 2018-10-01 | 2026-06-16 |
| CVE-2018-17143 | The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call. | [email protected] | 7.5 | 2.77% | 2018-09-17 | 2026-06-16 |
| CVE-2018-17142 | The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call. | [email protected] | 7.5 | 2.81% | 2018-09-17 | 2026-06-16 |
| CVE-2018-17075 | The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit. | [email protected] | 7.5 | 2.77% | 2018-09-15 | 2026-06-16 |