Golang.org/x/net vulnerabilities
27 CVEs and advisories name Golang.org/x/net as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-97045Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
- CVE-2026-78661Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
- CVE-2026-97032HTTP/2 server crash due to HPACK encoder race in net/http
- CVE-2026-78663Double flow control refund on HTTP/2 server streams in net/http
- CVE-2026-78669Excessive CPU consumption from repeated initial window changes in net/http
- CVE-2026-78660HTTP/2 transport accepts malformed framing-related headers in net/http
- CVE-2026-78659HTTP/2 server memory exhaustion due to Trailer headers in net/http
- CVE-2026-46600Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
- CVE-2026-27136Invoking duplicate attributes can cause XSS in golang.org/x/net/html
- CVE-2026-25681Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
- CVE-2026-25680Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
- CVE-2026-42502Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
- CVE-2026-39821Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
- CVE-2026-42506Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
- CVE-2026-33814Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
- CVE-2026-27141Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net
- CVE-2025-58190Infinite parsing loop in golang.org/x/net
- CVE-2025-47911Quadratic parsing complexity in golang.org/x/net/html
- CVE-2025-22872Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
- CVE-2025-22870HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
- CVE-2024-45338Non-linear parsing of case-insensitive content in golang.org/x/net/html
- CVE-2023-45288HTTP/2 CONTINUATION flood in net/http
- CVE-2023-39325HTTP/2 rapid reset can cause excessive work in net/http
- CVE-2023-3978Improper rendering of text nodes in golang.org/x/net/html
- CVE-2022-41723Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
- CVE-2022-41721Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
- CVE-2022-41717Excessive memory growth in net/http and golang.org/x/net/http2