Vendor
Golang.org/x/net
27 known vulnerabilities in products by Golang.org/x/net, 0 of them actively exploited (CISA KEV).
Key figures
27
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2023-45288 | HTTP/2 CONTINUATION flood in net/http | 7.5 | |
| Critical | CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | 10.0 | |
| High | CVE-2022-41723 | Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net | 7.5 | |
| High | CVE-2023-39325 | HTTP/2 rapid reset can cause excessive work in net/http | 7.5 | |
| Medium | CVE-2022-41717 | Excessive memory growth in net/http and golang.org/x/net/http2 | 5.3 | |
| High | CVE-2022-41721 | Request smuggling due to improper request handling in golang.org/x/net/http2/h2c | 7.5 | |
| High | CVE-2026-78659 | HTTP/2 server memory exhaustion due to Trailer headers in net/http | 7.5 | |
| High | CVE-2026-78663 | Double flow control refund on HTTP/2 server streams in net/http | 7.5 | |
| High | CVE-2026-78669 | Excessive CPU consumption from repeated initial window changes in net/http | 7.5 | |
| High | CVE-2026-33814 | Golang.org/x/net/http2: Infinite Loop | 7.5 | |
| High | CVE-2026-78660 | HTTP/2 transport accepts malformed framing-related headers in net/http | 7.5 | |
| High | CVE-2026-46600 | Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage | 7.5 | |
| Medium | CVE-2026-97032 | HTTP/2 server crash due to HPACK encoder race in net/http | 5.9 | |
| High | CVE-2026-27141 | Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net | 7.5 | |
| Medium | CVE-2024-45338 | Non-linear parsing of case-insensitive content in golang.org/x/net/html | 5.3 | |
| Medium | CVE-2023-3978 | Improper rendering of text nodes in golang.org/x/net/html | 6.1 | |
| Medium | CVE-2025-47911 | Quadratic parsing complexity in golang.org/x/net/html | 5.3 | |
| Medium | CVE-2025-22872 | Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net | 6.5 | |
| Medium | CVE-2025-58190 | Infinite parsing loop in golang.org/x/net | 5.3 | |
| Medium | CVE-2026-25680 | Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html | 6.5 | |
| Medium | CVE-2025-22870 | HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net | 4.4 | |
| Medium | CVE-2026-42506 | Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html | 6.1 | |
| Medium | CVE-2026-27136 | Invoking duplicate attributes can cause XSS in golang.org/x/net/html | 6.1 | |
| Medium | CVE-2026-25681 | Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html | 6.1 | |
| Medium | CVE-2026-42502 | Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html | 6.1 |
News
Products
| Golang.org/x/net/html | 12 | 0 |
| Golang.org/x/net/http2 | 11 | 0 |