The vulnerability of the golang-x-net package in the Golang programming language arises from an improper limitation on the visible layers of the user interface. This allows attackers to carry out clickjacking attacks.

🗓️ 25 Sep 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 7 Views

Remote clickjacking in golang-x-net due to improper UI layer visibility limitations.

Reporter	Title	Published	Views	Family All 1
CVE	CVE-2026-25681	22 May 202615:01	–	cve

Vulners

Node

OR

red_hat,red_hat_openshift_dataMatch4

red_hat,red_hat_openshift_container_platformMatch4

red_hat,red_hat_openshift_virtualizationMatch4

red_hat,red_hat_advanced_cluster_securityMatch4

red_hat,red_hat_openstack_platformMatch18.0

red_hat,red_hat_openshift_container_platformMatch4.16

red_hat,red_hat_openshift_container_platformMatch4.17

red_hat,cryostatMatch4

red_hat,red_hat_openshift_container_platformMatch4.18

red_hat,red_hat_openshift_container_platformMatch4.19

red_hat,assisted_installer_for_red_hat_openshift_container_platformMatch2

red_hat,openshift_api_for_data_protectionMatch1.3

red_hat,red_hat_satelliteMatch6.18

red_hat,red_hat_ansible_automation_platformMatch2.6

red_hat,red_hat_openshift_distributed_tracingMatch3

red_hat,red_hat_openshift_aiMatch2.25

red_hat,migration_toolkit_for_applicationsMatch8

red_hat,red_hat_openshift_container_platformMatch4.20

red_hat,red_hat_trusted_artifact_signerMatch1.4

red_hat,multicluster_engine_for_kubernetesMatch2.8

red_hat,red_hat_openshift_container_platformMatch4.21

red_hat,red_hat_openshift_container_platformMatch4.22

red_hat,red_hat_openshift_dataMatch4.22

red_hat,openshift_api_for_data_protectionMatch1.6

red_hat,red_hat_advanced_cluster_securityMatch4.9

red_hat,red_hat_edge_managerMatch1.1

red_hat,cluster_observability_operatorMatch1.5.0

red_hat,red_hat_openshift_buildsMatch1.8.1

red_hat,red_hat_openshift_gitopsMatch1.19

red_hat,red_hat_advanced_cluster_management_for_kubernetesMatch2.14

red_hat,red_hat_openshift_aiMatch3.4

red_hat,red_hat_openshift_dataMatch4.19

red_hat,multicluster_global_hubMatch1.6.5

red_hat,openshift_api_for_data_protectionMatch1.4

red_hat,red_hat_advanced_cluster_management_for_kubernetesMatch2.15

red_hat,red_hat_advanced_cluster_management_for_kubernetesMatch2.16

go golang.org/x/net/htmlRange<0.55.0

red_hat,multicluster_engine_for_kubernetesMatch2.11

red_hat,cert_manager_support_for_red_hat_openshift_releaseMatch1.19

red_hat,logging_for_red_hat_openshiftMatch6

red_hat,logging_subsystem_for_red_hat_openshiftMatch6.2

red_hat,logging_subsystem_for_red_hat_openshiftMatch6.4

red_hat,logging_subsystem_for_red_hat_openshiftMatch6.5

red_hat,multicluster_global_hubMatch1.4.9

red_hat,openshift_api_for_data_protectionMatch1.5

red_hat,red_hat_advanced_cluster_security_for_kubernetesMatch4.10

red_hat,red_hat_advanced_cluster_security_for_kubernetesMatch4.11

red_hat,red_hat_migration_toolkit_for_containersMatch1.8

red_hat,red_hat_migration_toolkit_for_applicationsMatch8.1

red_hat,red_hat_migration_toolkit_for_applicationsMatch8.2

red_hat,red_hat_multicluster_global_hubMatch1.5.3

red_hat,red_hat_openshift_dataMatch4.20

red_hat,red_hat_openshift_gitopsMatch1.20

red_hat,red_hat_openshift_workload_availabilityMatch0.12

red_hat,red_hat_openshift_workload_availabilityMatch0.13

red_hat,red_hat_openshift_workload_availabilityMatch0.3

red_hat,red_hat_openshift_workload_availabilityMatch0.7

red_hat,red_hat_openshift_workload_availabilityMatch0.8

red_hat,red_hat_openshift_workload_availabilityMatch5.7

red_hat,red_hat_enterprise_linuxMatch8

red_hat,red_hat_enterprise_linuxMatch9

red_hat,red_hat_enterprise_linuxMatch10

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-25681
github	www.github.com/advisories/GHSA-w9p8-pvxh-rxpj
go	www.go.dev/cl/781703
go	www.go.dev/issue/79574
groups	www.groups.google.com/g/golang-announce/c/iI-mYSI0lu8
pkg	www.pkg.go.dev/vuln/GO-2026-5029
redos	www.redos.red-soft.ru/support/secure/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2026-25681
deb	www.deb.freexian.com/extended-lts/tracker/CVE-2026-25681
access	www.access.redhat.com/security/cve/CVE-2026-25681

25 Sep 2026 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 36.1

CVSS 26.4

EPSS0.00223

golang-x-net clickjacking remote attack Golang