Skip to main content
cve.nowby Sazabi
← Go
GoPackage

golang.org/x/net/html

12 known vulnerabilities (1 high, 10 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 1 high, 10 medium
Registry
pkg.go.dev

Advisories 12

  • CVE-2026-97045Medium 6.1

    Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

    Affected: fixed in 0.62.0.

  • Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

    Affected: fixed in 0.62.0.

  • CVE-2026-27136Medium 6.1

    Invoking duplicate attributes can cause XSS in golang.org/x/net/html

    Affected: fixed in 0.55.0.

  • CVE-2026-25681Medium 6.1

    Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

    Affected: fixed in 0.55.0.

  • CVE-2026-25680Medium 6.5

    Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

    Affected: fixed in 0.55.0.

  • CVE-2026-42502Medium 6.1

    Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

    Affected: fixed in 0.55.0.

  • CVE-2026-42506Medium 6.1

    Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

    Affected: fixed in 0.55.0.

  • CVE-2025-58190Medium 5.3

    Infinite parsing loop in golang.org/x/net

    Affected: fixed in 0.45.0.

  • CVE-2025-47911Medium 5.3

    Quadratic parsing complexity in golang.org/x/net/html

    Affected: fixed in 0.45.0; fixed in 0.45.0.

  • CVE-2025-22872Medium 6.5

    Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

    Affected: fixed in 0.38.0.

  • CVE-2024-45338Medium 5.3

    Non-linear parsing of case-insensitive content in golang.org/x/net/html

    Affected: fixed in 0.33.0; fixed in 0.33.0.

  • Improper rendering of text nodes in golang.org/x/net/html

    Affected: fixed in 0.13.0.