Filtered by vendor Golang Subscriptions
Filtered by product Net Subscriptions

Search

Switch to Advanced Search (Beta)
Total 19 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-42507 1 Golang 1 Net 2026-06-03 5.3 Medium
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.
CVE-2026-42502 1 Golang 1 Net 2026-05-29 6.1 Medium
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-42506 1 Golang 1 Net 2026-05-29 6.1 Medium
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-27136 1 Golang 1 Net 2026-05-29 6.1 Medium
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-25680 1 Golang 1 Net 2026-05-29 6.5 Medium
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
CVE-2026-25681 1 Golang 1 Net 2026-05-29 6.1 Medium
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-39821 1 Golang 1 Net 2026-05-29 9.6 Critical
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
CVE-2025-47910 2 Go Standard Library, Golang 3 Net\/http, Http2, Net 2026-04-15 5.4 Medium
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
CVE-2025-58186 1 Golang 1 Net 2026-04-15 5.3 Medium
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
CVE-2025-47911 2 Go, Golang 2 Html, Net 2026-02-18 5.3 Medium
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
CVE-2025-58190 2 Go, Golang 2 Html, Net 2026-02-18 5.3 Medium
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
CVE-2025-61724 1 Golang 2 Go, Net 2026-01-29 5.3 Medium
The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.
CVE-2025-47912 1 Golang 2 Go, Net 2026-01-29 5.3 Medium
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
CVE-2018-17848 2 Fedoraproject, Golang 2 Fedora, Net 2024-11-21 7.5 High
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.
CVE-2018-17847 2 Fedoraproject, Golang 2 Fedora, Net 2024-11-21 7.5 High
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.
CVE-2018-17846 2 Fedoraproject, Golang 2 Fedora, Net 2024-11-21 7.5 High
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.
CVE-2018-17143 2 Fedoraproject, Golang 2 Fedora, Net 2024-11-21 7.5 High
The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.
CVE-2018-17142 2 Fedoraproject, Golang 2 Fedora, Net 2024-11-21 7.5 High
The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.
CVE-2018-17075 2 Fedoraproject, Golang 2 Fedora, Net 2024-11-21 7.5 High
The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit.