Quadratic parsing complexity in golang.org/x/net/html
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| golang.org/x/net | golang.org/x/net/html | unaffected |
|
No data.
| Vendor | Product | Versions |
|---|---|---|
| Golang | Net | — |
| Source | ID | Title |
|---|---|---|
Github GHSA |
GHSA-w4gw-w5jq-g9jh | golang.org/x/net/html has a Quadratic Parsing Complexity issue |
Ubuntu USN |
USN-8089-1 | Go Networking vulnerabilities |
Ubuntu USN |
USN-8089-2 | Go Networking vulnerabilities |
Ubuntu USN |
USN-8089-3 | ADSys, Juju Core, LXD vulnerabilities |
Ubuntu USN |
USN-8900-1 | Go Networking vulnerabilities |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.561% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Go
Go html |
|
| Weaknesses | NVD-CWE-noinfo | |
| CPEs | cpe:2.3:a:go:html:*:*:*:*:*:go:*:* | |
| Vendors & Products |
Go
Go html |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-400 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Golang
Golang net |
|
| Vendors & Products |
Golang
Golang net |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | |
| Title | Quadratic parsing complexity in golang.org/x/net/html | |
| References |
|