Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 50

Export CSV
CVE-2026-97045

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Net
CVE-2026-78661

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Net
CVE-2026-42499

Quadratic string concatenation in consumePhrase in net/mail

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Net\/mail Go
CVE-2026-39821

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

CVSS 3.1 · 9.6 Critical EPSS 1.8% KEV · Not listed
Vendors
Golang
Products
Net
CVE-2026-39820

Quadratic string concatentation in consumeComment in net/mail

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Net/mail Go
CVE-2026-25679

Incorrect parsing of IPv6 host literals in net/url

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Net/url Go
CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Net/http Go Http2
CVE-2026-33811

Crash when handling long CNAME response in net

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Net Go
CVE-2025-61726

Memory exhaustion in query parameter parsing in net/url

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Net/url Go
CVE-2026-46600

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Net
CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed
Vendors
Akka Amazon Apache and 30 more
Products
Http Server Opensearch Data Prepper Apisix and 375 more
CVE-2026-42507

Arbitrary inputs are included in errors without any escaping in net/textproto

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Net
CVE-2023-24540

Improper handling of JavaScript whitespace in html/template

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Advanced Cluster Security and 17 more
CVE-2026-42502

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Net
CVE-2026-42506

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Net
CVE-2026-27136

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Net
CVE-2026-25680

Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Net
CVE-2026-25681

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Net
CVE-2026-39825

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Net/http Go
CVE-2026-39836

Panic in Dial and LookupPort when handling NUL byte on Windows in net

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Net Go