Every CVE Search/ Get API key

CVE-2026-42502

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

6.1 MediumFix available

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.22%Up 0.2 points since May 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
CVE-2026-42502
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
EUVDEUVD-2026-31448 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
EUVD-2026-31448
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wrh2-89vg-4j9g 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree....

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
GHSA-wrh2-89vg-4j9g
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-1021
Updated
2026-11-02
NVD 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
CVE-2026-42502
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-1021
Updated
2026-11-02
OSVBELL-CVE-2026-42502 6.1
Record
BELL-CVE-2026-42502
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSV 6.1

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
CVE-2026-42502
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 48 moreShow less
OSVDEBIAN-CVE-2026-42502 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
DEBIAN-CVE-2026-42502
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:51112 8.2

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:51112
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:59560 8.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:59560
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:59562 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:59562
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:61585 8.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:61585
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:62391 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:62391
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:63134 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:63134
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:66432 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:66432
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:66561 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:66561
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67138 8.1

Red Hat Security Advisory: image-builder security update

Record
RHSA-2026:67138
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67139 8.1

Red Hat Security Advisory: image-builder security update

Record
RHSA-2026:67139
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67517 8.8

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:67517
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:69293 8.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:69293
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:66432 8.2

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:66432
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:67138 8.1

Important: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67138
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:67139 8.1

Important: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67139
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:69293 8.1

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69293
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-42502 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
UBUNTU-CVE-2026-42502
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:66432 No score

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:66432
Updated
2026-11-02
OSVALSA-2026:69293 No score

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69293
Updated
2026-11-02
OSVAZL-111638 No score

CVE-2026-42502 affecting package kubevirt-openvmm 1.9.0-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-111638
Updated
2026-11-05
OSVAZL-87149 No score

CVE-2026-42502 affecting package azl-otel-collector 0.127.0-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87149
Updated
2026-11-05
OSVAZL-87245 No score

CVE-2026-42502 affecting package cri-o 1.30.1-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87245
Updated
2026-11-05
OSVAZL-87317 No score

CVE-2026-42502 affecting package podman 5.6.1-10

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87317
Updated
2026-11-05
OSVAZL-87332 No score

CVE-2026-42502 affecting package yq 4.45.1-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87332
Updated
2026-11-05
OSVAZL-87372 No score

CVE-2026-42502 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87372
Updated
2026-11-05
OSVAZL-87420 No score

CVE-2026-42502 affecting package cert-manager for versions less than 1.12.15-9

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87420
Updated
2026-11-05
OSVAZL-87456 No score

CVE-2026-42502 affecting package cf-cli for versions less than 8.7.11-7

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87456
Updated
2026-11-05
OSVAZL-87489 No score

CVE-2026-42502 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87489
Updated
2026-11-05
OSVAZL-87519 No score

CVE-2026-42502 affecting package cni-plugins for versions less than 1.4.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87519
Updated
2026-11-05
OSVAZL-87531 No score

CVE-2026-42502 affecting package containerd2 for versions less than 2.2.4-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87531
Updated
2026-11-02
OSVAZL-87549 No score

CVE-2026-42502 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87549
Updated
2026-11-05
OSVAZL-87588 No score

CVE-2026-42502 affecting package cri-tools for versions less than 1.32.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87588
Updated
2026-11-05
OSVAZL-87597 No score

CVE-2026-42502 affecting package dasel for versions less than 2.8.1-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87597
Updated
2026-11-05
OSVAZL-87639 No score

CVE-2026-42502 affecting package docker-buildx for versions less than 0.14.0-15

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87639
Updated
2026-11-05
OSVAZL-87669 No score

CVE-2026-42502 affecting package docker-compose for versions less than 2.27.0-12

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87669
Updated
2026-11-02
OSVAZL-87744 No score

CVE-2026-42502 affecting package gh for versions less than 2.62.0-17

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87744
Updated
2026-11-02
OSVAZL-87828 No score

CVE-2026-42502 affecting package influxdb for versions less than 2.7.5-17

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87828
Updated
2026-11-02
OSVAZL-87864 No score

CVE-2026-42502 affecting package keda for versions less than 2.14.1-14

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87864
Updated
2026-11-02
OSVAZL-87885 No score

CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87885
Updated
2026-11-02
OSVAZL-87924 No score

CVE-2026-42502 affecting package kubernetes for versions less than 1.30.10-25

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87924
Updated
2026-11-05
OSVAZL-87951 No score

CVE-2026-42502 affecting package kubevirt for versions less than 1.7.1-7

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87951
Updated
2026-11-05
OSVAZL-88107 No score

CVE-2026-42502 affecting package multus for versions less than 4.0.2-9

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-88107
Updated
2026-11-05
OSVAZL-88209 No score

CVE-2026-42502 affecting package packer for versions less than 1.9.5-15

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-88209
Updated
2026-11-02
OSVAZL-88233 No score

CVE-2026-42502 affecting package prometheus-adapter for versions less than 0.12.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-88233
Updated
2026-11-05
OSVAZL-88299 No score

CVE-2026-42502 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-88299
Updated
2026-11-02
OSVAZL-88341 No score

CVE-2026-42502 affecting package telegraf for versions less than 1.31.0-23

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-88341
Updated
2026-11-02
OSVCLSA-2026-1789657645 No score

osbuild-composer: Fix of CVE-2026-42502

  • CVE-2026-42502: treat foster-parented raw-text elements in foreign content as escaped rather than literal in childTextNodesAreLiteral of the vendored golang.org/x/net/html, preventing a cross-site scripting bypass when a parsed tree is re-rendered
Record
CLSA-2026-1789657645
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
osbuild-composer
AlmaLinux:10
From an advisory covering 6 CVEs
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer-core
AlmaLinux:10
From an advisory covering 6 CVEs
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer-worker
AlmaLinux:10
From an advisory covering 6 CVEs
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer
AlmaLinux:9
From an advisory covering 5 CVEs
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
osbuild-composer-core
AlmaLinux:9
From an advisory covering 5 CVEs
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
osbuild-composer-worker
AlmaLinux:9
From an advisory covering 5 CVEs
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
kubevirt-openvmm
Azure Linux:3
 through 1.9.0-1 None known
azl-otel-collector
Azure Linux:3
 through 0.127.0-1 None known
cri-o
Azure Linux:3
 through 1.30.1-1 None known
podman
Azure Linux:3
 through 5.6.1-10 None known
Show 250 moreShow less
Affected packages
PackageAffectedFixed
yq
Azure Linux:3
 through 4.45.1-1 None known
application-gateway-kubernetes-ingress
Azure Linux:3
 before 1.7.7-5
1.7.7-5
cert-manager
Azure Linux:3
 before 1.12.15-9
1.12.15-9
cf-cli
Azure Linux:3
 before 8.7.11-7
8.7.11-7
cloud-provider-kubevirt
Azure Linux:3
 before 0.5.1-5
0.5.1-5
cni-plugins
Azure Linux:3
 before 1.4.0-6
1.4.0-6
containerd2
Azure Linux:3
 before 2.2.4-4
2.2.4-4
containerized-data-importer
Azure Linux:3
 before 1.62.0-6
1.62.0-6
cri-tools
Azure Linux:3
 before 1.32.0-6
1.32.0-6
dasel
Azure Linux:3
 before 2.8.1-4
2.8.1-4
docker-buildx
Azure Linux:3
 before 0.14.0-15
0.14.0-15
docker-compose
Azure Linux:3
 before 2.27.0-12
2.27.0-12
gh
Azure Linux:3
 before 2.62.0-17
2.62.0-17
influxdb
Azure Linux:3
 before 2.7.5-17
2.7.5-17
keda
Azure Linux:3
 before 2.14.1-14
2.14.1-14
kube-vip-cloud-provider
Azure Linux:3
 before 0.0.10-6
0.0.10-6
kubernetes
Azure Linux:3
 before 1.30.10-25
1.30.10-25
kubevirt
Azure Linux:3
 before 1.7.1-7
1.7.1-7
multus
Azure Linux:3
 before 4.0.2-9
4.0.2-9
packer
Azure Linux:3
 before 1.9.5-15
1.9.5-15
prometheus-adapter
Azure Linux:3
 before 0.12.0-6
0.12.0-6
sriov-network-device-plugin
Azure Linux:3
 before 3.7.0-6
3.7.0-6
telegraf
Azure Linux:3
 before 1.31.0-23
1.31.0-23
buildah
Alpaquita:23
 1.28.0-r1 and later None known
containerd
Alpaquita:23
 1.6.10-r0 and later None known
podman
Alpaquita:23
 4.3.1-r0 and later None known
runc
Alpaquita:23
 1.1.4-r3 and later None known
skopeo
Alpaquita:23
 1.10.0-r2 and later None known
buildah
Alpaquita:25
 1.40.0-r0 and later None known
containerd
Alpaquita:25
 2.1.1-r0 and later None known
docker-cli-buildx
Alpaquita:25
 0.24.0-r0 and later None known
google-guest-agent
Alpaquita:25
 20250521.00-r0 and later None known
osv-scanner
Alpaquita:25
 2.1.0-r4 and later None known
podman
Alpaquita:25
 5.5.0-r0 and later None known
rootlesskit
Alpaquita:25
 2.3.5-r0 and later None known
runc
Alpaquita:25
 1.3.0-r1 and later None known
skopeo
Alpaquita:25
 1.18.0-r2 and later None known
buildah
Alpaquita:stream
 1.31.0-r0 and later None known
calicoctl
Alpaquita:stream
 3.31.3-r0 and later None known
cilium-cli
Alpaquita:stream
 0.19.0-r12 and later None known
cni-plugins
Alpaquita:stream
 1.9.0-r2 and later None known
containerd
Alpaquita:stream
 1.7.2-r1 and later None known
cri-tools
Alpaquita:stream
 1.35.0-r2 and later None known
docker-cli-buildx
Alpaquita:stream
 0.11.0-r0 and later None known
etcd
Alpaquita:stream
 3.6.4-r6 and later None known
google-guest-agent
Alpaquita:stream
 20250214.01-r0 and later None known
grype
Alpaquita:stream
 0.100.0-r0 and later None known
helm
Alpaquita:stream
 3.19.0-r4 and later None known
osv-scanner
Alpaquita:stream
 2.1.0-r2 and later None known
podman
Alpaquita:stream
 4.5.1-r1 and later None known
rootlesskit
Alpaquita:stream
 2.1.0-r0 and later None known
runc
Alpaquita:stream
 1.1.7-r1 and later None known
skopeo
Alpaquita:stream
 1.13.0-r1 and later None known
osbuild-composer
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els9
132.2-3.el9_6.alma.1.tuxcare.els9
osbuild-composer-core
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els9
132.2-3.el9_6.alma.1.tuxcare.els9
osbuild-composer-tests
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els9
132.2-3.el9_6.alma.1.tuxcare.els9
osbuild-composer-worker
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els9
132.2-3.el9_6.alma.1.tuxcare.els9
osbuild-composer
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els13
76-2.el9_2.2.alma.tuxcare.els13
osbuild-composer-core
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els13
76-2.el9_2.2.alma.tuxcare.els13
osbuild-composer-dnf-json
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els13
76-2.el9_2.2.alma.tuxcare.els13
osbuild-composer-tests
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els13
76-2.el9_2.2.alma.tuxcare.els13
osbuild-composer-worker
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els13
76-2.el9_2.2.alma.tuxcare.els13
golang-golang-x-net
Debian:12
 All versions, plus listed versions
1:0.10.0-11:0.11.0-11:0.14.0-11:0.15.0-11:0.15.0-2
Show 22 moreShow less
1:0.17.0+dfsg-11:0.19.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.22.0+dfsg-11:0.23.0+dfsg-11:0.24.0+dfsg-11:0.25.0+dfsg-11:0.26.0+dfsg-11:0.26.0+dfsg-21:0.27.0-11:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.7.0+dfsg-1
 None known
golang-golang-x-net
Debian:13
 All versions, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-2
Show 5 moreShow less
1:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-1
 None known
golang-golang-x-net
Debian:14
 before 1:0.55.0-1, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+1
1:0.55.0-1
golang.org/x/net
Go
 before 0.55.0
0.55.0
grafana
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 6 CVEs
 before 0:10.2.6-22.el9_6
0:10.2.6-22.el9_6
grafana-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 6 CVEs
 before 0:10.2.6-22.el9_6
0:10.2.6-22.el9_6
grafana-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 6 CVEs
 before 0:10.2.6-22.el9_6
0:10.2.6-22.el9_6
grafana-selinux
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 6 CVEs
 before 0:10.2.6-22.el9_6
0:10.2.6-22.el9_6
osbuild-composer
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 3 CVEs
 before 0:132.2-11.el9_6
0:132.2-11.el9_6
osbuild-composer-core
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 3 CVEs
 before 0:132.2-11.el9_6
0:132.2-11.el9_6
osbuild-composer-core-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 3 CVEs
 before 0:132.2-11.el9_6
0:132.2-11.el9_6
osbuild-composer-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 3 CVEs
 before 0:132.2-11.el9_6
0:132.2-11.el9_6
osbuild-composer-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 3 CVEs
 before 0:132.2-11.el9_6
0:132.2-11.el9_6
osbuild-composer-tests-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 3 CVEs
 before 0:132.2-11.el9_6
0:132.2-11.el9_6
osbuild-composer-worker
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 3 CVEs
 before 0:132.2-11.el9_6
0:132.2-11.el9_6
osbuild-composer-worker-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 3 CVEs
 before 0:132.2-11.el9_6
0:132.2-11.el9_6
osbuild-composer
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:101.3-4.el9_4.5
0:101.3-4.el9_4.5
osbuild-composer-core
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:101.3-4.el9_4.5
0:101.3-4.el9_4.5
osbuild-composer-core-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:101.3-4.el9_4.5
0:101.3-4.el9_4.5
osbuild-composer-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:101.3-4.el9_4.5
0:101.3-4.el9_4.5
osbuild-composer-debugsource
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:101.3-4.el9_4.5
0:101.3-4.el9_4.5
osbuild-composer-tests-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:101.3-4.el9_4.5
0:101.3-4.el9_4.5
osbuild-composer-worker
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:101.3-4.el9_4.5
0:101.3-4.el9_4.5
osbuild-composer-worker-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:101.3-4.el9_4.5
0:101.3-4.el9_4.5
osbuild-composer
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-core
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-core-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-dnf-json
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-tests-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-worker
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-worker-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
golang1.26
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:1.26.8-0.1.hum1
0:1.26.8-0.1.hum1
golang1.26-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:1.26.8-0.1.hum1
0:1.26.8-0.1.hum1
golang1.26-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:1.26.8-0.1.hum1
0:1.26.8-0.1.hum1
golang1.26-misc
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:1.26.8-0.1.hum1
0:1.26.8-0.1.hum1
golang1.26-src
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:1.26.8-0.1.hum1
0:1.26.8-0.1.hum1
golang1.26-tests
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:1.26.8-0.1.hum1
0:1.26.8-0.1.hum1
osbuild-composer
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-core
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-core-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-tests-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-worker
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-worker-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-core
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-core-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-tests-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-worker
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-worker-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
golang1.27
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:1.27.1-0.1.hum1
0:1.27.1-0.1.hum1
golang1.27-bin
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:1.27.1-0.1.hum1
0:1.27.1-0.1.hum1
golang1.27-docs
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:1.27.1-0.1.hum1
0:1.27.1-0.1.hum1
golang1.27-misc
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:1.27.1-0.1.hum1
0:1.27.1-0.1.hum1
golang1.27-src
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:1.27.1-0.1.hum1
0:1.27.1-0.1.hum1
golang1.27-tests
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:1.27.1-0.1.hum1
0:1.27.1-0.1.hum1
image-builder
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:52.1-2.el9_8
0:52.1-2.el9_8
image-builder-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:52.1-2.el9_8
0:52.1-2.el9_8
image-builder-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:52.1-2.el9_8
0:52.1-2.el9_8
image-builder
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:52.1-2.el10_2
0:52.1-2.el10_2
image-builder-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:52.1-2.el10_2
0:52.1-2.el10_2
image-builder-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:52.1-2.el10_2
0:52.1-2.el10_2
grafana
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 20 CVEs
 before 0:10.2.6-26.el10_0
0:10.2.6-26.el10_0
grafana-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 20 CVEs
 before 0:10.2.6-26.el10_0
0:10.2.6-26.el10_0
grafana-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 20 CVEs
 before 0:10.2.6-26.el10_0
0:10.2.6-26.el10_0
grafana-selinux
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 20 CVEs
 before 0:10.2.6-26.el10_0
0:10.2.6-26.el10_0
osbuild-composer
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-core
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-core-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-worker
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-worker-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2.rocky.0.1
0:165.1-5.el10_2.rocky.0.1
image-builder
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:52.1-2.el9_8
0:52.1-2.el9_8
image-builder
Rocky Linux:10
From an advisory covering 4 CVEs
 before 0:52.1-2.el10_2.rocky.0.1
0:52.1-2.el10_2.rocky.0.1
osbuild-composer
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8.rocky.0.1
0:165.1-5.el9_8.rocky.0.1
golang.org/x/net
Root:Go
 before v0.42.0-aikido.3
v0.42.0-aikido.3v0.39.0-aikido.4v0.34.0-aikido.3v0.33.0-aikido.7v0.35.0-aikido.3v0.35.0-aikido.2v0.50.0-aikido.1v0.40.0-aikido.1v0.26.0-aikido.2v0.50.0-aikido.2v0.38.0-aikido.3v0.41.0-aikido.1v0.42.0-aikido.1v0.48.0-aikido.1v0.33.0-aikido.5v0.39.0-aikido.1v0.52.0-aikido.1v0.47.0-aikido.1v0.39.0-aikido.2v0.35.0-aikido.1v0.33.0-aikido.6v0.39.0-aikido.3v0.42.0-aikido.2v0.48.0-aikido.2v0.34.0-aikido.1v0.52.0-aikido.2v0.34.0-aikido.2v0.37.0-aikido.1v0.47.0-aikido.2v0.43.0-aikido.1v0.29.0-aikido.1v0.41.0-aikido.2v0.40.0-aikido.2v0.38.0-aikido.4v0.54.0-aikido.1v0.23.0-aikido.1v0.29.0-aikido.2v0.29.0-aikido.3v0.47.0-aikido.3v0.35.0-aikido.4v0.54.0-aikido.2v0.38.0-aikido.5v0.40.0-aikido.3v0.35.0-aikido.5v0.41.0-aikido.3v0.47.0-aikido.4v0.49.0-aikido.1v0.52.0-aikido.3v0.52.0-aikido.4v0.29.0-aikido.4v0.38.0-aikido.6v0.41.0-aikido.4v0.40.0-aikido.4v0.47.0-aikido.5v0.54.0-aikido.3v0.52.0-aikido.5v0.29.0-aikido.5v0.43.0-aikido.2v0.54.0-aikido.4v0.23.0-aikido.2v0.23.0-aikido.3v0.29.0-aikido.6v0.39.0-aikido.5v0.42.0-aikido.4v0.39.0-aikido.6
rootio-golang.org/x/net
Root:Go
 before v0.42.0-root.io.3
v0.42.0-root.io.3v0.39.0-root.io.4v0.34.0-root.io.3v0.33.0-root.io.7v0.35.0-root.io.3v0.41.0-root.io.1v0.35.0-root.io.2v0.50.0-root.io.1v0.40.0-root.io.1v0.26.0-root.io.2v0.38.0-root.io.3v0.50.0-root.io.2v0.42.0-root.io.1v0.48.0-root.io.1v0.33.0-root.io.5v0.39.0-root.io.1v0.52.0-root.io.1v0.47.0-root.io.1v0.39.0-root.io.2v0.35.0-root.io.1v0.33.0-root.io.6v0.39.0-root.io.3v0.42.0-root.io.2v0.48.0-root.io.2v0.34.0-root.io.1v0.52.0-root.io.2v0.34.0-root.io.2v0.37.0-root.io.1v0.47.0-root.io.2v0.43.0-root.io.1v0.29.0-root.io.1v0.41.0-root.io.2v0.40.0-root.io.2v0.38.0-root.io.4v0.54.0-root.io.1v0.23.0-root.io.1v0.29.0-root.io.2v0.29.0-root.io.3v0.47.0-root.io.3v0.35.0-root.io.4v0.54.0-root.io.2v0.38.0-root.io.5v0.40.0-root.io.3v0.35.0-root.io.5v0.41.0-root.io.3v0.47.0-root.io.4v0.49.0-root.io.1v0.52.0-root.io.3v0.52.0-root.io.4v0.29.0-root.io.4v0.38.0-root.io.6v0.41.0-root.io.4v0.40.0-root.io.4v0.47.0-root.io.5v0.54.0-root.io.3v0.52.0-root.io.5v0.29.0-root.io.5v0.43.0-root.io.2v0.54.0-root.io.4v0.23.0-root.io.2v0.23.0-root.io.3v0.29.0-root.io.6v0.39.0-root.io.5v0.42.0-root.io.4v0.39.0-root.io.6
elemental-toolkit
SUSE:Linux Micro 6.0
From an advisory covering 19 CVEs
 before 2.1.6-1.1
2.1.6-1.1
elemental-operator
SUSE:Linux Micro 6.0
From an advisory covering 9 CVEs
 before 1.6.11-1.1
1.6.11-1.1
elemental-toolkit
SUSE:Linux Micro 6.1
From an advisory covering 19 CVEs
 before 2.2.9-slfo.1.1_1.1
2.2.9-slfo.1.1_1.1
elemental-operator
SUSE:Linux Micro 6.1
From an advisory covering 9 CVEs
 before 1.7.5-slfo.1.1_1.1
1.7.5-slfo.1.1_1.1
mcphost
SUSE:Linux Enterprise Server 16.0
From an advisory covering 20 CVEs
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
mcphost
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 20 CVEs
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
mcphost
SUSE:Linux Micro 6.2
From an advisory covering 20 CVEs
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
alloy
SUSE:Linux Enterprise Server 16.0
From an advisory covering 26 CVEs
 before 1.17.0-160000.1.1
1.17.0-160000.1.1
alloy
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 26 CVEs
 before 1.17.0-160000.1.1
1.17.0-160000.1.1
cosign
SUSE:Linux Enterprise Server 16.0
From an advisory covering 19 CVEs
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
cosign
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 19 CVEs
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 25 CVEs
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 25 CVEs
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 25 CVEs
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 25 CVEs
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
dracut-saltboot
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.2.1-150002.3.9.1
1.2.1-150002.3.9.1
golang-github-QubitProducts-exporter_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.4.0-150002.3.6.2
0.4.0-150002.3.6.2
golang-github-boynux-squid_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.13.0-150002.3.6.2
1.13.0-150002.3.6.2
golang-github-lusitaniae-apache_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.0.10-150002.3.9.2
1.0.10-150002.3.9.2
golang-github-prometheus-alertmanager
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.28.1-150002.4.11.1
0.28.1-150002.4.11.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.10.2-150002.3.6.2
1.10.2-150002.3.6.2
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 3.5.3-150002.3.13.1
3.5.3-150002.3.13.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 11.6.14+security04-150002.4.21.1
11.6.14+security04-150002.4.21.1
mgr-push
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.4-150002.3.9.1
5.2.4-150002.3.9.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.26.0-150002.3.11.1
0.26.0-150002.3.11.1
prometheus-postgres_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.10.1-150002.3.3.2
0.10.1-150002.3.3.2
python-defusedxml-sle15
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.7.1-150002.1.3.1
0.7.1-150002.1.3.1
rhnlib
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.5-150002.3.9.1
5.2.5-150002.3.9.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.8-150002.3.12.1
5.2.8-150002.3.12.1
spacewalk-client-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.6-150002.3.9.1
5.2.6-150002.3.9.1
supportutils-plugin-salt
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.2.3-150002.3.3.1
1.2.3-150002.3.3.1
supportutils-plugin-susemanager-client
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.3-150002.3.9.1
5.2.3-150002.3.9.1
uyuni-common-libs
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.5-150002.3.6.1
5.2.5-150002.3.6.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.12-150002.3.17.1
5.2.12-150002.3.17.1
dracut-saltboot
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 1.2.1-150002.3.9.1
1.2.1-150002.3.9.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 1.10.2-150002.3.6.2
1.10.2-150002.3.6.2
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 5.2.12-150002.3.17.1
5.2.12-150002.3.17.1
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 27 CVEs
 before 1.17.1-150700.15.23.1
1.17.1-150700.15.23.1
cosign
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
kubevirt
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 21 CVEs
 before 1.7.4-150700.3.30.1
1.7.4-150700.3.30.1
kubevirt-1.6
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 16 CVEs
 before 1.6.6-150700.15.17.1
1.6.6-150700.15.17.1
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 22 CVEs
 before 12.4.5-150200.3.91.1
12.4.5-150200.3.91.1
containerized-data-importer
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 27 CVEs
 before 1.64.0-150700.9.14.1
1.64.0-150700.9.14.1
golang-golang-x-net-dev
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.0+git20150226.3d87fd6-30.0+git20151007.b846920+dfsg-11:0.0+git20150817.66f0418-11:0.0+git20160110.4fd4a9f-11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
 None known
golang-golang-x-net-dev
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:0.0+git20170629.c81e7f2+dfsg-1ubuntu11:0.0+git20170629.c81e7f2+dfsg-1ubuntu21:0.0+git20170629.c81e7f2+dfsg-21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm11:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3
 None known
golang-golang-x-net-dev
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1:0.0+git20190811.74dc4d7+dfsg-11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm21:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3
 None known
rclone
openSUSE:Tumbleweed
From an advisory covering 23 CVEs
 before 1.74.2-1.1
1.74.2-1.1
mcphost
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 0.34.0-8.1
0.34.0-8.1
yq
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 4.53.2-2.1
4.53.2-2.1
trivy
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 0.71.0-1.1
0.71.0-1.1
velociraptor
openSUSE:Tumbleweed
From an advisory covering 49 CVEs
 before 0.7.0.4.git185.a5708584-2.1
0.7.0.4.git185.a5708584-2.1
gomuks
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 26.03+git.1780250926.564a8707-1.1
26.03+git.1780250926.564a8707-1.1
zabbix
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 7.0.28-1.1
7.0.28-1.1
percona-toolkit
openSUSE:Tumbleweed
From an advisory covering 10 CVEs
 before 3.7.1.4-1.1
3.7.1.4-1.1
trivy
openSUSE:Leap 16.0
From an advisory covering 21 CVEs
 before 0.71.0-160000.1.1
0.71.0-160000.1.1
neonmodem
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 1.0.7+git0.346d1d3-bp160.1.1
1.0.7+git0.346d1d3-bp160.1.1
grafana
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 11.6.14+security04-bp160.2.1
11.6.14+security04-bp160.2.1
mcphost
openSUSE:Leap 16.0
From an advisory covering 20 CVEs
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
alloy
openSUSE:Leap 16.0
From an advisory covering 26 CVEs
 before 1.17.0-160000.1.1
1.17.0-160000.1.1
hauler
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 2.0.1-bp160.1.1
2.0.1-bp160.1.1
cosign
openSUSE:Leap 16.0
From an advisory covering 19 CVEs
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
lux
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 0.24.1-bp160.1.1
0.24.1-bp160.1.1
rclone
openSUSE:Leap 16.0
From an advisory covering 37 CVEs
 before 1.74.4-bp160.1.1
1.74.4-bp160.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 1734 CVEs
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1
kubevirt1.8
openSUSE:Leap 16.0
From an advisory covering 25 CVEs
 before 1.8.4-160000.1.1
1.8.4-160000.1.1
glab
openSUSE:Leap 16.0
From an advisory covering 24 CVEs
 before 1.114.0-bp160.1.1
1.114.0-bp160.1.1
containerized-data-importer1.65
openSUSE:Leap 16.0
From an advisory covering 39 CVEs
 before 1.65.0-160000.3.1
1.65.0-160000.3.1

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42502 is a medium vulnerability (CVSS 6.1) in Golang Net, published May 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in application-gateway-kubernetes-ingress 1.7.7-5.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 2,059 references. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 44 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open