{"id":"CVE-2018-17075","aliases":["BELL-CVE-2018-17075","EUVD-2022-2622","GHSA-5p4h-3377-7w67","GO-2021-0078"],"status":"published","title":"golang.org/x/net/html NULL Pointer Dereference vulnerability","description":"The html package (aka x/net/html) before 2018-07-13 in Go mishandles \"in frameset\" insertion mode, leading to a \"panic: runtime error\" for html.Parse of \u003ctemplate\u003e\u003cobject\u003e, \u003ctemplate\u003e\u003capplet\u003e, or \u003ctemplate\u003e\u003cmarquee\u003e. This is related to HTMLTreeBuilder.cpp in WebKit.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02774,"percentile":0.86441,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2018-09-16T02:00:00Z","modified":"2026-10-20T10:51:37Z","fixes":[{"ecosystem":"Go","package":"golang.org/x/net","fixed_in":["0.0.0-20180816102801-aaf60122140d"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"golang.org/x/net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20180816102801-aaf60122140d"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/net","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20180816102801-aaf60122140d"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/net","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20180816102801-aaf60122140d"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"golang","product":"net"}],"references":[{"url":"https://github.com/golang/net/commit/aaf60122140d3fcf75376d319f0554393160eb50","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://bugs.chromium.org/p/chromium/issues/detail?id=829668","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/golang/go/issues/27016","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17075","tags":["advisory"]},{"url":"https://go-review.googlesource.com/c/net/+/94838/9/html/parse.go#1906","tags":["web"]},{"url":"https://go.dev/cl/123776","tags":["web","fix"]},{"url":"https://go.dev/issue/27016","tags":["web","report"]},{"url":"https://go.googlesource.com/net/+/aaf60122140d3fcf75376d319f0554393160eb50","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0078","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5p4h-3377-7w67"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-17075","tags":["advisory"]},{"url":"https://github.com/golang/go","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-17075","description":"The html package (aka x/net/html) before 2018-07-13 in Go mishandles \"in frameset\" insertion mode, leading to a \"panic: runtime error\" for html.Parse of \u003ctemplate\u003e\u003cobject\u003e, \u003ctemplate\u003e\u003capplet\u003e, or \u003ctemplate\u003e\u003cmarquee\u003e. This is related to HTMLTreeBuilder.cpp in WebKit.","status":"published","published":"2018-09-16T02:00:00Z","modified":"2024-08-05T10:39:59.557Z","updated_at":"2026-11-02T14:35:07.672841Z"}],"euvd":[{"id":"EUVD-2022-2622","description":"The html package (aka x/net/html) before 2018-07-13 in Go mishandles \"in frameset\" insertion mode, leading to a \"panic: runtime error\" for html.Parse of \u003ctemplate\u003e\u003cobject\u003e, \u003ctemplate\u003e\u003capplet\u003e, or \u003ctemplate\u003e\u003cmarquee\u003e. This is related to HTMLTreeBuilder.cpp in WebKit.","status":"published","published":"2018-09-16T02:00:00Z","modified":"2024-08-05T10:39:59Z","updated_at":"2026-11-03T02:39:39.229856Z"}],"ghsa":[{"id":"GHSA-5p4h-3377-7w67","title":"golang.org/x/net/html NULL Pointer Dereference vulnerability","description":"The html package (aka x/net/html) before 2018-07-13 in Go mishandles \"in frameset\" insertion mode, leading to a \"panic: runtime error\" for html.Parse of \u003ctemplate\u003e\u003cobject\u003e, \u003ctemplate\u003e\u003capplet\u003e, or \u003ctemplate\u003e\u003cmarquee\u003e. This is related to HTMLTreeBuilder.cpp in WebKit.","status":"published","published":"2022-05-13T01:19:22Z","modified":"2024-05-20T19:54:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2018-17075","description":"The html package (aka x/net/html) before 2018-07-13 in Go mishandles \"in frameset\" insertion mode, leading to a \"panic: runtime error\" for html.Parse of \u003ctemplate\u003e\u003cobject\u003e, \u003ctemplate\u003e\u003capplet\u003e, or \u003ctemplate\u003e\u003cmarquee\u003e. This is related to HTMLTreeBuilder.cpp in WebKit.","status":"published","published":"2018-09-16T02:29:00.947Z","modified":"2026-06-17T01:45:19.62Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:40.661264Z"}],"osv":[{"id":"BELL-CVE-2018-17075","title":"CVE-2018-17075 does not affect BellSoft software","status":"withdrawn","published":"2018-09-16T02:29:00Z","modified":"2026-01-26T09:48:52.060287Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-17075","description":"The html package (aka x/net/html) before 2018-07-13 in Go mishandles \"in frameset\" insertion mode, leading to a \"panic: runtime error\" for html.Parse of \u003ctemplate\u003e\u003cobject\u003e, \u003ctemplate\u003e\u003capplet\u003e, or \u003ctemplate\u003e\u003cmarquee\u003e. This is related to HTMLTreeBuilder.cpp in WebKit.","status":"published","published":"2018-09-16T02:29:00.947Z","modified":"2026-10-20T10:51:37.354517805Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"GHSA-5p4h-3377-7w67","title":"golang.org/x/net/html NULL Pointer Dereference vulnerability","description":"The html package (aka x/net/html) before 2018-07-13 in Go mishandles \"in frameset\" insertion mode, leading to a \"panic: runtime error\" for html.Parse of \u003ctemplate\u003e\u003cobject\u003e, \u003ctemplate\u003e\u003capplet\u003e, or \u003ctemplate\u003e\u003cmarquee\u003e. This is related to HTMLTreeBuilder.cpp in WebKit.","status":"published","published":"2022-05-13T01:19:22Z","modified":"2024-05-20T19:54:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"GO-2021-0078","title":"Panic when parsing malformed HTML in golang.org/x/net/html","description":"The HTML parser does not properly handle \"in frameset\" insertion mode, and can be made to panic when operating on malformed HTML that contains \u003ctemplate\u003e tags. If operating on user input, this may be a vector for a denial of service attack.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}