Net

net

Vendor: Golang • 12 CVEs

CVEs (12)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-42506 1Golang 1Net Jul 23, 2026 May 22, 2026 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-42502 1Golang 1Net Jul 23, 2026 May 22, 2026 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-39821 1Golang 1Net Jul 24, 2026 May 22, 2026 N/A· v4 9.6 CRITICAL· v3 N/A· v2 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an erro...Show more The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".Show less
CVE-2026-27136 1Golang 1Net Jul 23, 2026 May 22, 2026 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-25681 1Golang 1Net Jul 23, 2026 May 22, 2026 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-25680 1Golang 1Net Jul 23, 2026 May 22, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
CVE-2018-17848 2Fedoraproject Golang 2Fedora Net Nov 21, 2024 Oct 1, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (insertionModeStack).pop in node.go, called from inHe...Show more The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.Show less
CVE-2018-17847 2Fedoraproject Golang 2Fedora Net Nov 21, 2024 Oct 1, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (nodeStack).pop in node.go, called from (parse...Show more The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (nodeStack).pop in node.go, called from (parser).clearActiveFormattingElements, during an html.Parse call.Show less
CVE-2018-17846 2Fedoraproject Golang 2Fedora Net Nov 21, 2024 Oct 1, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not compl...Show more The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.Show less
CVE-2018-17143 2Fedoraproject Golang 2Fedora Net Nov 21, 2024 Sep 17, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.
CVE-2018-17142 2Fedoraproject Golang 2Fedora Net Nov 21, 2024 Sep 17, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.
CVE-2018-17075 2Fedoraproject Golang 2Fedora Net Nov 21, 2024 Sep 16, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. Thi...Show more The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit.Show less