What’s Vulnerable › Products

golang.org/x/net/html vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your golang.org/x/net/html version is affected

Latest golang.org/x/net/html vulnerabilities

• CVE-2026-97045 — Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
• CVE-2026-78661 — Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
• CVE-2026-46600 — Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage (CVSS 7.5)
• CVE-2026-42506 — Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html (CVSS 6.1)
• CVE-2026-42502 — Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html (CVSS 6.1)
• CVE-2026-39821 — Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna (CVSS 9.6)
• CVE-2026-27136 — Invoking duplicate attributes can cause XSS in golang.org/x/net/html (CVSS 6.1)
• CVE-2026-25681 — Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html (CVSS 6.1)
• CVE-2026-25680 — Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html (CVSS 6.5)
• CVE-2025-22872 — Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net (CVSS 6.5)
• CVE-2024-45338 — Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVSS 5.3)
• CVE-2024-24788 — Malformed DNS message can cause infinite loop in net (CVSS 5.9)
• CVE-2018-17848 — (CVSS 7.5)
• CVE-2018-17847 — (CVSS 7.5)
• CVE-2018-17846 — (CVSS 7.5)
• CVE-2018-17143 — (CVSS 7.5)
• CVE-2018-17142 — (CVSS 7.5)
• CVE-2018-17075 — (CVSS 7.5)