Skip to contentGolang.org/x/net vulnerabilities
Newest
- golang.org/x/net golang.org/x/net/htmlCheck all ancestor namespace transitions when rendering raw text in html in golang.org/x/netCVE-2026-97045Fix available6.1 Medium
- golang.org/x/net golang.org/x/net/htmlAvoid quadratic complexity when coalescing text nodes in html in golang.org/x/netCVE-2026-78661Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 server crash due to HPACK encoder race in net/httpCVE-2026-97032Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreExcessive CPU consumption from repeated initial window changes in net/httpCVE-2026-78669Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreDouble flow control refund on HTTP/2 server streams in net/httpCVE-2026-78663Fix available9.1 Critical
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 server memory exhaustion due to Trailer headers in net/httpCVE-2026-78659Fix available7.5 High
- go standard library net, golang.org/x/net golang.org/x/net/dns/dnsmessage +1 moreParsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessageCVE-2026-46600Fix available7.5 High
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/htmlCVE-2026-42506Fix available6.1 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlCVE-2026-42502Fix available6.1 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking duplicate attributes can cause XSS in golang.org/x/net/htmlCVE-2026-27136Fix available6.1 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/htmlCVE-2026-25681Fix available6.1 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking denial of service when parsing arbitrary HTML in golang.org/x/net/htmlCVE-2026-25680Fix available6.5 Medium
- go standard library net/http, golang go, http2 +106 more +108 moreInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814Fix available7.5 High
- golang.org/x/net golang.org/x/net/http2Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/netCVE-2026-27141Fix available7.5 High
- go html, golang.org/x/net golang.org/x/net/html +1 moreInfinite parsing loop in golang.org/x/netCVE-2025-58190Fix available5.3 Medium
- go html, golang.org/x/net golang.org/x/net/html +1 moreQuadratic parsing complexity in golang.org/x/net/htmlCVE-2025-47911Fix available5.3 Medium
- golang.org/x/net golang.org/x/net/htmlIncorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/netCVE-2025-22872Fix available6.5 Medium
- go standard library net/http, golang.org/x/net golang.org/x/net/http/httpproxy, golang.org/x/net/proxy +2 moreHTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netCVE-2025-22870Public exploitFix available4.4 Medium
- golang.org/x/net golang.org/x/net/htmlNon-linear parsing of case-insensitive content in golang.org/x/net/htmlCVE-2024-45338Fix available5.3 Medium
- go standard library net/http, net\/http, golang http2 +1 more +3 moreHTTP/2 CONTINUATION flood in net/httpCVE-2023-45288Public exploitFix availableEPSS 89.5%7.5 High
- go standard library net/http, golang go, http2 +4 more +6 moreHTTP/2 rapid reset can cause excessive work in net/httpCVE-2023-39325Public exploitFix available7.5 High
- golang.org/x/net golang.org/x/net/html, golang networking +1 moreImproper rendering of text nodes in golang.org/x/net/htmlCVE-2023-3978Fix available6.1 Medium
- go standard library net/http, golang go, hpack +3 more +5 moreDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/netCVE-2022-41723Fix available7.5 High
- golang h2c, golang.org/x/net golang.org/x/net/http2/h2c +1 moreRequest smuggling due to improper request handling in golang.org/x/net/http2/h2cCVE-2022-41721Fix available7.5 High
- go standard library net/http, golang go, http2 +2 more +4 moreExcessive memory growth in net/http and golang.org/x/net/http2CVE-2022-41717Public exploitFix available5.3 Medium
- golang net, golang.org/x/net golang.org/x/net/idna, go standard library net/http +147 more +149 moreInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821Fix available9.6 Critical