# cve.now: Golang.org/x/net

The newest entries naming Golang.org/x/net as an affected vendor (up to 200), of 27 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-97045](https://cve.now/CVE-2026-97045.md): Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net (CVSS 6.1)
- [CVE-2026-78661](https://cve.now/CVE-2026-78661.md): Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net (CVSS 7.5)
- [CVE-2026-97032](https://cve.now/CVE-2026-97032.md): HTTP/2 server crash due to HPACK encoder race in net/http (CVSS 7.5)
- [CVE-2026-78663](https://cve.now/CVE-2026-78663.md): Double flow control refund on HTTP/2 server streams in net/http (CVSS 9.1)
- [CVE-2026-78669](https://cve.now/CVE-2026-78669.md): Excessive CPU consumption from repeated initial window changes in net/http (CVSS 7.5)
- [CVE-2026-78660](https://cve.now/CVE-2026-78660.md): HTTP/2 transport accepts malformed framing-related headers in net/http (CVSS 7.5)
- [CVE-2026-78659](https://cve.now/CVE-2026-78659.md): HTTP/2 server memory exhaustion due to Trailer headers in net/http (CVSS 7.5)
- [CVE-2026-46600](https://cve.now/CVE-2026-46600.md): Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage (CVSS 7.5)
- [CVE-2026-27136](https://cve.now/CVE-2026-27136.md): Invoking duplicate attributes can cause XSS in golang.org/x/net/html (CVSS 6.1)
- [CVE-2026-25681](https://cve.now/CVE-2026-25681.md): Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html (CVSS 6.1)
- [CVE-2026-25680](https://cve.now/CVE-2026-25680.md): Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html (CVSS 6.5)
- [CVE-2026-42502](https://cve.now/CVE-2026-42502.md): Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html (CVSS 6.1)
- [CVE-2026-39821](https://cve.now/CVE-2026-39821.md): Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna (CVSS 9.6)
- [CVE-2026-42506](https://cve.now/CVE-2026-42506.md): Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html (CVSS 6.1)
- [CVE-2026-33814](https://cve.now/CVE-2026-33814.md): Infinite loop in HTTP/2 transport when given bad SETTINGS\_MAX\_FRAME\_SIZE in net/http/internal/http2 in golang.org/x/net (CVSS 7.5)
- [CVE-2026-27141](https://cve.now/CVE-2026-27141.md): Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net (CVSS 7.5)
- [CVE-2025-58190](https://cve.now/CVE-2025-58190.md): Infinite parsing loop in golang.org/x/net (CVSS 5.3)
- [CVE-2025-47911](https://cve.now/CVE-2025-47911.md): Quadratic parsing complexity in golang.org/x/net/html (CVSS 5.3)
- [CVE-2025-22872](https://cve.now/CVE-2025-22872.md): Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net (CVSS 6.5)
- [CVE-2025-22870](https://cve.now/CVE-2025-22870.md): HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net (CVSS 4.4)
- [CVE-2024-45338](https://cve.now/CVE-2024-45338.md): Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVSS 5.3)
- [CVE-2023-45288](https://cve.now/CVE-2023-45288.md): HTTP/2 CONTINUATION flood in net/http (CVSS 7.5)
- [CVE-2023-39325](https://cve.now/CVE-2023-39325.md): HTTP/2 rapid reset can cause excessive work in net/http (no CVSS)
- [CVE-2023-3978](https://cve.now/CVE-2023-3978.md): Improper rendering of text nodes in golang.org/x/net/html (no CVSS)
- [CVE-2022-41723](https://cve.now/CVE-2022-41723.md): Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net (CVSS 7.5)
- [CVE-2022-41721](https://cve.now/CVE-2022-41721.md): Request smuggling due to improper request handling in golang.org/x/net/http2/h2c (CVSS 7.5)
- [CVE-2022-41717](https://cve.now/CVE-2022-41717.md): Excessive memory growth in net/http and golang.org/x/net/http2 (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/golang-org-x-net
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.