Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 50

Export CSV
CVE-2022-41717

Excessive memory growth in net/http and golang.org/x/net/http2

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

CVSS 3.1 · 5.3 Medium EPSS 6.2% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Http2 and 22 more
CVE-2023-29400

Improper handling of empty HTML attributes in html/template

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Advanced Cluster Security and 19 more
CVE-2023-24539

Improper sanitization of CSS values in html/template

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.

CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Advanced Cluster Security and 19 more
CVE-2023-3978

Improper rendering of text nodes in golang.org/x/net/html

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Golang Redhat
Products
Networking Cryostat Enterprise Linux and 5 more
CVE-2018-17848

golang-org-x-net-html: index out of range in (*insertionModeStack).pop in node.go causes runtime panic during html.Parse() call

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Golang
Products
Fedora Net
CVE-2018-17847

golang-org-x-net-html: index out of range in (*nodeStack).pop in node.go causes runtime panic during html.Parse() call

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Fedoraproject Golang
Products
Fedora Net
CVE-2018-17846

golang-org-x-net-html: infinite loop during html.Parse() via inSelectIM and inSelectInTableIM

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Golang
Products
Fedora Net
CVE-2018-17143

golang-org-x-net-html: Runtime panic in html.Parse() via crafted html

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Golang
Products
Fedora Net
CVE-2018-17142

golang-org-x-net-html: Runtime panic in html.Parse() via crafted html

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Fedoraproject Golang
Products
Fedora Net
CVE-2018-17075

golang-org-x-net-html: Mishandle of "in frameset" causes runtime panic in html.Parse() via crafted html

The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Golang
Products
Fedora Net