golang.org/x/net golang.org/x/net/html
12 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-97045 | < 0.62.0 | Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net | 0.2 % | |||
| CVE-2026-78661 | < 0.62.0 | Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net | 0.2 % | |||
| CVE-2026-27136 | < 0.55.0 | Invoking duplicate attributes can cause XSS in golang.org/x/net/html | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-42506 | < 0.55.0 | Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-42502 | < 0.55.0 | Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-25681 | < 0.55.0 | Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-25680 | < 0.55.0 | Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-58190 | < 0.45.0 | Infinite parsing loop in golang.org/x/net | MEDIUM 5.3 | 0.5 % | ||
| CVE-2025-47911 | < 0.45.0 | Quadratic parsing complexity in golang.org/x/net/html | MEDIUM 5.3 | 0.6 % | ||
| CVE-2025-22872 | < 0.38.0 | Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-45338 | < 0.33.0 | Non-linear parsing of case-insensitive content in golang.org/x/net/html | MEDIUM 5.3 | 1.1 % | ||
| CVE-2023-3978 | < 0.13.0 | Improper rendering of text nodes in golang.org/x/net/html | MEDIUM 6.1 | 0.9 % |