CVE-2026-39821

The golang.org/x/net/idna package contains a vulnerability where the ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to ASCII-only labels. For instance, ToUnicode("xn--example-.com") returns "example.com" instead of an error. This flaw can lead to privilege ...

CVE-2018-17847

The CVE-2018-17847 entry describes a denial of service condition in Go’s html package (x/net/html) triggered by parsing HTML that includes certain SVG/Template constructs. The root cause is an index-out-of-range fault in nodeStack.pop called during html.Parse, which can be exploited by sending a ...

CVE-2018-17848

CVE-2018-17848 affects Go’s html package (x/net/html); the vulnerability is a denial of service via a panic: runtime error (index out of range) in insertionModeStack.pop called from inHeadIM during html.Parse when encountering specific tags like . The initial description notes the parser mishandl...

CVE-2026-25680

Parsing arbitrary HTML can consume excessive CPU time , potentially leading to a denial of service (DoS). This vulnerability affects multiple packages, including docker , containerd , containerd2 , cloud-provider-kubevirt , cf-cli , cni-plugins , multus , keda , gh , and dasel . Specific affected...

CVE-2026-27136

Parsing arbitrary HTML and rendering it using Render can result in an unexpected HTML tree , which may be leveraged to execute XSS attacks in applications attempting to sanitize input HTML before rendering. This vulnerability affects the golang.org/x/net/html package. Impacted products include do...

CVE-2026-25681

The golang.org/x/net/html library is vulnerable to Arbitrary code execution via Cross-Site Scripting (XSS) because parsing arbitrary HTML and rendering it via Render can produce an unexpected HTML tree. This flaw can be exploited by attackers in applications that attempt to sanitize input HTML be...

CVE-2026-42506

A vulnerability exists where parsing arbitrary HTML and rendering it using Render can produce an unexpected HTML tree. This flaw can be exploited to perform XSS attacks in applications that attempt to sanitize input HTML before rendering. The vulnerability affects several products including IBM M...

CVE-2026-42502

Parsing arbitrary HTML that is subsequently rendered using Render can result in an unexpected HTML tree. This vulnerability allows attackers to bypass input sanitization to execute XSS attacks in affected applications. The issue is present in several products and components, including watsonx.dat...

CVE-2018-17142

CVE-2018-17142: Golang Go html package vulnerability (html.Parse) causing a runtime panic due to invalid memory address. Public records show IBM bulletins listing this CVE within IBM Storage Defender – Data Protect and related IBM products, with remediation involving upgrading to a newer fixed re...

CVE-2018-17143

CVE-2018-17143 affects the Go html parser (x/net/html). The vulnerability arises from how the html package handles a crafted input fragment , which can cause a panic: runtime error in inBodyIM during an html.Parse call. The description and related advisories (GHSA/GITLAB entries) confirm the issu...

CVE-2018-17075

CVE-2018-17075 affects Go’s html package (x/net/html) prior to 2018-07-13. The vulnerability arises from mishandling the htmlParse insertion mode in frameset contexts, causing a panic: runtime error when parsing crafted HTML like , , or . The issue is linked to HTMLTreeBuilder.cpp in WebKit. The ...

CVE-2018-17846

CVE-2018-17846: The Go html package (x/net/html) up to 2018-09-25 mishandles certain HTML fragments, causing an infinite loop in html.Parse due to inSelectIM and inSelectInTableIM noncompliance with the spec. Impact described as denial of service (infinite loop) during parsing. Connected sources ...