This page lists publicly disclosed CVE vulnerabilities affecting golang net (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-42506 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | [email protected] | 6.1 | 0.03% | 2026-05-22 | 2026-05-29 |
| CVE-2026-42502 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | [email protected] | 6.1 | 0.03% | 2026-05-22 | 2026-05-29 |
| CVE-2026-39821 | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to U | [email protected] | 9.6 | 0.05% | 2026-05-22 | 2026-05-29 |
| CVE-2026-27136 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | [email protected] | 6.1 | 0.03% | 2026-05-22 | 2026-05-29 |
| CVE-2026-25681 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | [email protected] | 6.1 | 0.03% | 2026-05-22 | 2026-05-29 |
| CVE-2026-25680 | Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. | [email protected] | 6.5 | 0.06% | 2026-05-22 | 2026-05-29 |
| CVE-2018-17848 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call. | [email protected] | 7.5 | 0.69% | 2018-10-01 | 2024-11-21 |
| CVE-2018-17847 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call. | [email protected] | 7.5 | 0.69% | 2018-10-01 | 2024-11-21 |
| CVE-2018-17846 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification. | [email protected] | 7.5 | 0.65% | 2018-10-01 | 2024-11-21 |
| CVE-2018-17143 | The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call. | [email protected] | 7.5 | 0.65% | 2018-09-17 | 2024-11-21 |
| CVE-2018-17142 | The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call. | [email protected] | 7.5 | 0.75% | 2018-09-17 | 2024-11-21 |
| CVE-2018-17075 | The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit. | [email protected] | 7.5 | 0.74% | 2018-09-16 | 2024-11-21 |