Vulnerability GO-2026-5027

Unknown

5 months ago

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

<0.55.0

Summary

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Details

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown

16 days ago

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

<0.62.0 GO-2026-6860

Unknown

16 days ago

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

<0.62.0 GO-2026-6866

Unknown

1 month ago

HTTP/2 server memory exhaustion due to Trailer headers in net/http

<0.60.0 GO-2026-6603

Unknown

1 month ago

HTTP/2 transport accepts malformed framing-related headers in net/http

<0.60.0 GO-2026-6610

Unknown

1 month ago

Excessive CPU consumption from repeated initial window changes in net/http

<0.60.0 GO-2026-6611

View all vulnerabilities for these packages

Impacted packages

golang.org/x/net

Timeline

Published

5 months ago

Fixed (v0.55.0)

5 months ago

Last Modified

1 hour ago