Skip to main content
cve.nowby Sazabi
← Go
GoPackage

golang.org/x/net

40 known vulnerabilities (2 critical, 14 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release
v0.62.0 (Oct 27, 2026): no advisory affects it
Newest unaffected release
v0.62.0 (Oct 27, 2026), the latest release
Advisories
40 · 2 critical, 14 high, 11 medium
Releases
62 since v0.1.0 (Oct 19, 2022)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 40 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 40

  • CVE-2026-97045Medium 6.1

    Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

    Affected: fixed in 0.62.0.

    Fixed in v0.62.0 (released Oct 27, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

    Affected: fixed in 0.62.0.

    Fixed in v0.62.0 (released Oct 27, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • HTTP/2 server crash due to HPACK encoder race in net/http

    Affected: fixed in 0.60.0.

    Fixed in v0.60.0 (released Oct 8, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2026-78663Critical 9.1

    Double flow control refund on HTTP/2 server streams in net/http

    Affected: fixed in 0.60.0.

    Fixed in v0.60.0 (released Oct 8, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • Excessive CPU consumption from repeated initial window changes in net/http

    Affected: fixed in 0.60.0.

    Fixed in v0.60.0 (released Oct 8, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • HTTP/2 transport accepts malformed framing-related headers in net/http

    Affected: fixed in 0.60.0.

    Fixed in v0.60.0 (released Oct 8, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • HTTP/2 server memory exhaustion due to Trailer headers in net/http

    Affected: fixed in 0.60.0.

    Fixed in v0.60.0 (released Oct 8, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

    Affected: fixed in 0.56.0.

    Fixed in v0.56.0 (released Jun 9, 2026, 42 days before disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2026-27136Medium 6.1

    Invoking duplicate attributes can cause XSS in golang.org/x/net/html

    Affected: fixed in 0.55.0.

    Fixed in v0.55.0 (released May 22, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2026-25681Medium 6.1

    Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

    Affected: fixed in 0.55.0.

    Fixed in v0.55.0 (released May 22, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2026-25680Medium 6.5

    Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

    Affected: fixed in 0.55.0.

    Fixed in v0.55.0 (released May 22, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2026-42502Medium 6.1

    Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

    Affected: fixed in 0.55.0.

    Fixed in v0.55.0 (released May 22, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2026-39821Critical 9.6

    Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

    Affected: fixed in 0.55.0.

    Fixed in v0.55.0 (released May 22, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2026-42506Medium 6.1

    Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

    Affected: fixed in 0.55.0.

    Fixed in v0.55.0 (released May 22, 2026, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

    Affected: fixed in 0.53.0.

    Fixed in v0.53.0 (released Apr 9, 2026, 28 days before disclosure).

    The latest release, v0.62.0, is not affected.

Show all 40 advisoriesShow fewer advisories

  • Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

    Affected: from 0.50.0, fixed in 0.51.0.

    Fixed in v0.51.0 (released Feb 25, 2026, 1 day before disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2025-58190Medium 5.3

    Infinite parsing loop in golang.org/x/net

    Affected: fixed in 0.45.0.

    Fixed in v0.45.0 (released Oct 7, 2025, 121 days before disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2025-47911Medium 5.3

    Quadratic parsing complexity in golang.org/x/net/html

    Affected: fixed in 0.45.0.

    Fixed in v0.45.0 (released Oct 7, 2025, 121 days before disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2025-22872Medium 6.5

    Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

    Affected: fixed in 0.38.0.

    Fixed in v0.38.0 (released Mar 27, 2025, 20 days before disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2025-22870Medium 4.4

    HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

    Affected: fixed in 0.36.0.

    Fixed in v0.36.0 (released Mar 4, 2025, 8 days before disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2024-45338Medium 5.3

    Non-linear parsing of case-insensitive content in golang.org/x/net/html

    Affected: fixed in 0.33.0.

    Fixed in v0.33.0 (released Dec 18, 2024, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • HTTP/2 CONTINUATION flood in net/http

    Affected: fixed in 0.23.0.

    Fixed in v0.23.0 (released Apr 3, 2024, 1 day before disclosure).

    The latest release, v0.62.0, is not affected.

  • HTTP/2 rapid reset can cause excessive work in net/http

    Affected: fixed in 0.17.0.

    Fixed in v0.17.0 (released Oct 10, 2023, 1 day before disclosure).

    The latest release, v0.62.0, is not affected.

  • CVE-2023-44487High 7.5 · KEV

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    Affected: fixed in 0.17.0.

    Fixed in v0.17.0 (released Oct 10, 2023, the day of disclosure).

    The latest release, v0.62.0, is not affected.

  • Improper rendering of text nodes in golang.org/x/net/html

    Affected: fixed in 0.13.0.

    Fixed in v0.13.0 (released Aug 1, 2023, 1 day before disclosure).

    The latest release, v0.62.0, is not affected.

  • Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

    Affected: fixed in 0.7.0.

    Fixed in v0.7.0 (released Feb 14, 2023, 14 days before disclosure).

    The latest release, v0.62.0, is not affected.

  • Request smuggling due to improper request handling in golang.org/x/net/http2/h2c

    Affected: from 0.0.0-20220524220425-1d687d428aca, fixed in 0.1.1-0.20221104162952-702349b0e862.

    Fixed in v0.2.0 (released Nov 7, 2022, 67 days before disclosure, the advisory names 0.1.1-0.20221104162952-702349b0e862, which was never published).

    The latest release, v0.62.0, is not affected.

  • Excessive memory growth in net/http and golang.org/x/net/http2

    Affected: fixed in 0.4.0.

    Fixed in v0.4.0 (released Dec 6, 2022, 2 days before disclosure).

    The latest release, v0.62.0, is not affected.

  • In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang…

    Affected: fixed in 0.0.0-20220906165146-f3363e06e74c.

    Fixed in v0.1.0 (released Oct 19, 2022, 43 days after disclosure, the advisory names 0.0.0-20220906165146-f3363e06e74c, which was never published).

    The latest release, v0.62.0, is not affected.

  • net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via…

    Affected: fixed in 0.0.0-20211209124913-491a49abca63.

    Fixed in v0.1.0 (released Oct 19, 2022, 291 days after disclosure, the advisory names 0.0.0-20211209124913-491a49abca63, which was never published).

    The latest release, v0.62.0, is not affected.

  • net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to…

    Affected: fixed in 0.0.0-20210428140749-89ef3d95e781.

    Fixed in v0.1.0 (released Oct 19, 2022, 510 days after disclosure, the advisory names 0.0.0-20210428140749-89ef3d95e781, which was never published).

    The latest release, v0.62.0, is not affected.

  • golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted…

    Affected: fixed in 0.0.0-20210520170846-37e1c6afe023.

    Fixed in v0.1.0 (released Oct 19, 2022, 511 days after disclosure, the advisory names 0.0.0-20210520170846-37e1c6afe023, which was never published).

    The latest release, v0.62.0, is not affected.

  • Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

    Affected: fixed in 0.0.0-20190813141303-74dc4d7220e7.

    Fixed in v0.1.0 (released Oct 19, 2022, 1163 days after disclosure, the advisory names 0.0.0-20190813141303-74dc4d7220e7, which was never published).

    The latest release, v0.62.0, is not affected.

  • Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

    Affected: fixed in 0.0.0-20190813141303-74dc4d7220e7.

    Fixed in v0.1.0 (released Oct 19, 2022, 1163 days after disclosure, the advisory names 0.0.0-20190813141303-74dc4d7220e7, which was never published).

    The latest release, v0.62.0, is not affected.

  • The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime…

    Affected: fixed in 0.0.0-20190125002852-4b62a64f59f7.

    Fixed in v0.1.0 (released Oct 19, 2022, 1479 days after disclosure, the advisory names 0.0.0-20190125002852-4b62a64f59f7, which was never published).

    The latest release, v0.62.0, is not affected.

  • The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic…

    Affected: fixed in 0.0.0-20190125002852-4b62a64f59f7.

    Fixed in v0.1.0 (released Oct 19, 2022, 1479 days after disclosure, the advisory names 0.0.0-20190125002852-4b62a64f59f7, which was never published).

    The latest release, v0.62.0, is not affected.

  • The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite…

    Affected: fixed in 0.0.0-20190125091013-d26f9f9a57f3.

    Fixed in v0.1.0 (released Oct 19, 2022, 1479 days after disclosure, the advisory names 0.0.0-20190125091013-d26f9f9a57f3, which was never published).

    The latest release, v0.62.0, is not affected.

  • The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime…

    Affected: fixed in 0.0.0-20180921000356-2f5d2388922f.

    Fixed in v0.1.0 (released Oct 19, 2022, 1493 days after disclosure, the advisory names 0.0.0-20180921000356-2f5d2388922f, which was never published).

    The latest release, v0.62.0, is not affected.

  • The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error"…

    Affected: fixed in 0.0.0-20180925071336-cf3bd585ca2a.

    Fixed in v0.1.0 (released Oct 19, 2022, 1493 days after disclosure, the advisory names 0.0.0-20180925071336-cf3bd585ca2a, which was never published).

    The latest release, v0.62.0, is not affected.

  • The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for…

    Affected: fixed in 0.0.0-20180816102801-aaf60122140d.

    Fixed in v0.1.0 (released Oct 19, 2022, 1494 days after disclosure, the advisory names 0.0.0-20180816102801-aaf60122140d, which was never published).

    The latest release, v0.62.0, is not affected.