Product by Golang.org/x/net
Golang.org/x/net/html
12 known vulnerabilities in Golang.org/x/net/html (Golang.org/x/net), 0 of them actively exploited (CISA KEV).
Key figures
12
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2024-45338 | Non-linear parsing of case-insensitive content in golang.org/x/net/html | 5.3 | |
| Medium | CVE-2023-3978 | Improper rendering of text nodes in golang.org/x/net/html | 6.1 | |
| Medium | CVE-2025-47911 | Quadratic parsing complexity in golang.org/x/net/html | 5.3 | |
| Medium | CVE-2025-22872 | Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net | 6.5 | |
| Medium | CVE-2025-58190 | Infinite parsing loop in golang.org/x/net | 5.3 | |
| Medium | CVE-2026-25680 | Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html | 6.5 | |
| Medium | CVE-2026-42506 | Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html | 6.1 | |
| Medium | CVE-2026-27136 | Invoking duplicate attributes can cause XSS in golang.org/x/net/html | 6.1 | |
| Medium | CVE-2026-25681 | Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html | 6.1 | |
| Medium | CVE-2026-42502 | Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html | 6.1 | |
| Not rated | CVE-2026-97045 | Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net | — | |
| Not rated | CVE-2026-78661 | Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net | — |