Golang Org X Net
Monthly
Denial of service in the Go golang.org/x/net/dns/dnsmessage package allows remote attackers to crash any application that parses attacker-supplied DNS responses by sending a malformed SVCB or HTTPS resource record. When the declared size of a service-parameter value exceeds the remaining DNS message buffer, the parser panics instead of returning an error, taking down the DNS client, resolver, or proxy embedding this library. EPSS is low (0.15%) and there is no public exploit identified at time of analysis, but a vendor patch is available and the pre-conditions are trivial for any host that resolves DNS through untrusted responders.
Privilege escalation in Go's golang.org/x/net/idna package (all versions before 0.55.0) stems from ToASCII and ToUnicode accepting Punycode labels that decode to an ASCII-only label, so ToUnicode("xn--example-.com") returns "example.com" instead of an error. Applications that perform authorization checks on an ASCII hostname and then convert it to Unicode can be tricked into permitting a name that the direct check would have rejected. This is a library-level flaw (CVSS 9.6, scope-changed) reported by the Go team; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile).
Remote denial of service in Go's HTTP/2 stack (both golang.org/x/net/http2 and the net/http standard library) allows an unauthenticated attacker to hang the server by sending an HTTP/2 SETTINGS frame carrying SETTINGS_MAX_FRAME_SIZE = 0, which drives the transport into an unbounded loop of writing CONTINUATION frames (CWE-835). It is network-reachable with no authentication or user interaction (CVSS 7.5, availability-only impact), publicly available exploit code exists, and the SSVC framework flags it as automatable; it is not listed in CISA KEV and EPSS is negligible (0.01%). Because net/http embeds this HTTP/2 code, any Go service serving HTTP/2 on a vulnerable release is affected until upgraded.
Mutation XSS in golang.org/x/net/html allows attackers to bypass HTML sanitization by exploiting divergence between the parsed and rendered HTML tree. Applications that parse untrusted HTML using this library, sanitize the resulting tree, and then re-render it are vulnerable - the rendered output can differ structurally from the sanitized intermediate representation, reintroducing attacker-controlled script execution. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the network-accessible, no-authentication attack path with changed scope makes this relevant to any Go application handling user-supplied HTML.
Parser-differential XSS in golang.org/x/net/html allows sanitization bypass when applications parse-sanitize-reserialize HTML before rendering. The Go HTML parser produces an unexpected tree structure for certain crafted inputs, meaning a sanitizer that walks the first-pass parse tree and deems content safe may produce output that, when re-parsed by a browser or downstream renderer, yields a structurally different - and dangerous - DOM. Affected are all applications using golang.org/x/net/html versions prior to 0.55.0 that rely on this library as part of an HTML sanitization pipeline; no confirmed active exploitation (CISA KEV) and EPSS is 0.03%, but the attack class (mutation XSS) is well-understood and high-value for targeted web application attacks.
Excessive CPU consumption in the golang.org/x/net/html package's HTML parser allows remote attackers to cause denial of service by supplying crafted HTML input to any Go application that parses untrusted markup using this library. All versions before 0.55.0 are confirmed affected per EUVD-2026-31447 and the Go vulnerability database (GO-2026-5028). No active exploitation has been identified - CISA SSVC rates exploitation as 'none' and the EPSS score of 0.04% (13th percentile) indicates very low observed exploitation probability at time of analysis.
Mutation XSS in Go's golang.org/x/net/html package allows attackers to bypass HTML sanitization by exploiting a discrepancy between how the html.Parse() function constructs an internal tree and how html.Render() serializes it back. Applications that rely on this package to sanitize untrusted HTML before display are vulnerable: maliciously crafted input can survive sanitization and execute JavaScript in victims' browsers when the rendered output is viewed. No public exploit exists at time of analysis, though the Go security team has issued a fix in version 0.55.0.
XSS sanitization bypass in Go's extended networking HTML parser (golang.org/x/net/html) allows remote unauthenticated attackers to execute cross-site scripting payloads against victims of Go web applications that rely on the library's parse-sanitize-render pipeline. The vulnerability arises because html.Render() can serialize a parsed and sanitized node tree into HTML output that structurally diverges from the sanitized intermediate representation, causing attacker-controlled content to re-materialize in rendered output. No active exploitation is confirmed (CISA KEV absent, EPSS 0.03%), but any Go application using this library as a sanitization layer is structurally exposed until upgraded to version 0.55.0.
Denial of service in the Go golang.org/x/net/dns/dnsmessage package allows remote attackers to crash any application that parses attacker-supplied DNS responses by sending a malformed SVCB or HTTPS resource record. When the declared size of a service-parameter value exceeds the remaining DNS message buffer, the parser panics instead of returning an error, taking down the DNS client, resolver, or proxy embedding this library. EPSS is low (0.15%) and there is no public exploit identified at time of analysis, but a vendor patch is available and the pre-conditions are trivial for any host that resolves DNS through untrusted responders.
Privilege escalation in Go's golang.org/x/net/idna package (all versions before 0.55.0) stems from ToASCII and ToUnicode accepting Punycode labels that decode to an ASCII-only label, so ToUnicode("xn--example-.com") returns "example.com" instead of an error. Applications that perform authorization checks on an ASCII hostname and then convert it to Unicode can be tricked into permitting a name that the direct check would have rejected. This is a library-level flaw (CVSS 9.6, scope-changed) reported by the Go team; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile).
Remote denial of service in Go's HTTP/2 stack (both golang.org/x/net/http2 and the net/http standard library) allows an unauthenticated attacker to hang the server by sending an HTTP/2 SETTINGS frame carrying SETTINGS_MAX_FRAME_SIZE = 0, which drives the transport into an unbounded loop of writing CONTINUATION frames (CWE-835). It is network-reachable with no authentication or user interaction (CVSS 7.5, availability-only impact), publicly available exploit code exists, and the SSVC framework flags it as automatable; it is not listed in CISA KEV and EPSS is negligible (0.01%). Because net/http embeds this HTTP/2 code, any Go service serving HTTP/2 on a vulnerable release is affected until upgraded.
Mutation XSS in golang.org/x/net/html allows attackers to bypass HTML sanitization by exploiting divergence between the parsed and rendered HTML tree. Applications that parse untrusted HTML using this library, sanitize the resulting tree, and then re-render it are vulnerable - the rendered output can differ structurally from the sanitized intermediate representation, reintroducing attacker-controlled script execution. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the network-accessible, no-authentication attack path with changed scope makes this relevant to any Go application handling user-supplied HTML.
Parser-differential XSS in golang.org/x/net/html allows sanitization bypass when applications parse-sanitize-reserialize HTML before rendering. The Go HTML parser produces an unexpected tree structure for certain crafted inputs, meaning a sanitizer that walks the first-pass parse tree and deems content safe may produce output that, when re-parsed by a browser or downstream renderer, yields a structurally different - and dangerous - DOM. Affected are all applications using golang.org/x/net/html versions prior to 0.55.0 that rely on this library as part of an HTML sanitization pipeline; no confirmed active exploitation (CISA KEV) and EPSS is 0.03%, but the attack class (mutation XSS) is well-understood and high-value for targeted web application attacks.
Excessive CPU consumption in the golang.org/x/net/html package's HTML parser allows remote attackers to cause denial of service by supplying crafted HTML input to any Go application that parses untrusted markup using this library. All versions before 0.55.0 are confirmed affected per EUVD-2026-31447 and the Go vulnerability database (GO-2026-5028). No active exploitation has been identified - CISA SSVC rates exploitation as 'none' and the EPSS score of 0.04% (13th percentile) indicates very low observed exploitation probability at time of analysis.
Mutation XSS in Go's golang.org/x/net/html package allows attackers to bypass HTML sanitization by exploiting a discrepancy between how the html.Parse() function constructs an internal tree and how html.Render() serializes it back. Applications that rely on this package to sanitize untrusted HTML before display are vulnerable: maliciously crafted input can survive sanitization and execute JavaScript in victims' browsers when the rendered output is viewed. No public exploit exists at time of analysis, though the Go security team has issued a fix in version 0.55.0.
XSS sanitization bypass in Go's extended networking HTML parser (golang.org/x/net/html) allows remote unauthenticated attackers to execute cross-site scripting payloads against victims of Go web applications that rely on the library's parse-sanitize-render pipeline. The vulnerability arises because html.Render() can serialize a parsed and sanitized node tree into HTML output that structurally diverges from the sanitized intermediate representation, causing attacker-controlled content to re-materialize in rendered output. No active exploitation is confirmed (CISA KEV absent, EPSS 0.03%), but any Go application using this library as a sanitization layer is structurally exposed until upgraded to version 0.55.0.