CLEANSTART-2026-FR88036 norm

Security vulnerability affects the cri-tools package. A norm...

CLEANSTART-2026-PN99410 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Security vulnerability affects the cri-tools package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CLEANSTART-2026-YY41698 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Security vulnerability affects the cri-tools package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...

CLEANSTART-2026-HP71482 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-MJ25147 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-WP33718 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

Security vulnerability affects the cri-tools package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CLEANSTART-2026-GJ32089 html

Security vulnerability affects the cri-tools package. The html...

CLEANSTART-2026-OR73025 tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing

Security vulnerability affects the cri-tools package. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing...

CLEANSTART-2026-CN84558 attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames

Security vulnerability affects the cri-tools package. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames...

CLEANSTART-2026-HI26609 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the cri-tools package. When returning errors, functions in the net/textproto package would include its input as part of the error...

CLEANSTART-2026-EI89098 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the cri-tools package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CLEANSTART-2026-EP02666 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the cri-tools package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

CLEANSTART-2026-IO94492 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Security vulnerability affects the cri-tools package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CLEANSTART-2026-NJ60272 Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

Security vulnerability affects the cri-tools package. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0...

CLEANSTART-2026-HK83739 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the cri-tools package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-WA32728 ReverseProxy can forward queries containing parameters not visible to Rewrite functions

Security vulnerability affects the cri-tools package. ReverseProxy can forward queries containing parameters not visible to Rewrite functions...

CLEANSTART-2026-GO32360 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the cri-tools package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-VB61301 On Unix systems, opening a file in an os

Security vulnerability affects the cri-tools package. On Unix systems, opening a file in an os...

CLEANSTART-2026-YT99957 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

Security vulnerability affects the cri-tools package. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...

CLEANSTART-2026-KR88876 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Security vulnerability affects the cri-tools package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...