The vulnerability of the golang-x-net package in the Golang programming language arises from the lack of security measures for handling web page structures, allowing attackers to execute arbitrary code.

🗓️ 25 Sep 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 10 Views

Remote code execution in golang-x-net via lack of security measures for web page structures.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Cluster Export Services (CES) S3 are now addressed in 5.2.3.9 or higher and 6.0.1.0 or higher	24 Jul 202615:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Verify Antenna is affected by multiple vulnerabilities	6 Oct 202614:22	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in net	2 Jul 202612:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (June 2026 - Part 2 of 2)	7 Jul 202607:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Liberty Operator is affected by multiple vulnerabilities	24 Jun 202616:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39821, CVE-2026-42502, CVE-2026-42506	3 Aug 202608:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	21 Aug 202608:20	–	ibm
attackerkb	CVE-2026-42506	22 May 202615:01	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : nerdctl (ALAS2023-2026-1788)	8 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : docker (ALAS2023-2026-1835)	12 Jun 202600:00	–	nessus

Vulners

Node

OR

red_hat,red_hat_quayMatch3

red_hat,red_hat_3scale_api_management_platformMatch2

red_hat,red_hat_openshift_dataMatch4

red_hat,red_hat_openshift_container_platformMatch4

red_hat,red_hat_satelliteMatch6

red_hat,red_hat_openstack_platformMatch16.2

red_hat,red_hat_ceph_storageMatch5

red_hat,red_hat_openshift_virtualizationMatch4

red_hat,red_hat_ansible_automation_platformMatch2

red_hat,red_hat_openstack_platformMatch17.1

red_hat,red_hat_advanced_cluster_securityMatch4

red_hat,red_hat_ceph_storageMatch7

red_hat,red_hat_openstack_platformMatch18.0

red_hat,red_hat_ceph_storageMatch8

red_hat,cryostatMatch4

red_hat,openshift_service_meshMatch3

red_hat,assisted_installer_for_red_hat_openshift_container_platformMatch2

red_hat,red_hat_ceph_storageMatch9

red_hat,red_hat_connectivity_linkMatch1

red_hat,red_hat_openshift_distributed_tracingMatch3

red_hat,migration_toolkit_for_applicationsMatch8

red_hat,red_hat_edge_managerMatch1

red_hat,red_hat_service_interconnectMatch2

red_hat,gatekeeperMatch3

red_hat,red_hat_openshift_dataMatch4.22

red_hat,openshift_api_for_data_protectionMatch1.6

red_hat,cluster_observability_operatorMatch1.5.0

go golang.org/x/net/htmlRange<0.55.0

red_hat,multicluster_engine_for_kubernetesMatch2.11

red_hat,red_hat_enterprise_linuxMatch8

red_hat,red_hat_enterprise_linuxMatch9

red_hat,red_hat_enterprise_linuxMatch10

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42506
github	www.github.com/advisories/GHSA-cg87-vwwh-xvgj
go	www.go.dev/cl/781700
go	www.go.dev/issue/79571
groups	www.groups.google.com/g/golang-announce/c/iI-mYSI0lu8
pkg	www.pkg.go.dev/vuln/GO-2026-5025
redos	www.redos.red-soft.ru/support/secure/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2026-42506
deb	www.deb.freexian.com/extended-lts/tracker/CVE-2026-42506
access	www.access.redhat.com/security/cve/CVE-2026-42506

25 Sep 2026 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 36.1

CVSS 26.4

EPSS0.00333

golang-x-net Golang remote code execution web page structures