Go to main page
Versions in this module
v0
Sep 8, 2026
Aug 12, 2026
Jul 8, 2026
Jun 9, 2026
May 22, 2026 GO-2026-5942
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
May 8, 2026 GO-2026-5025 +6 more
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Apr 9, 2026 GO-2026-5025 +6 more
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Mar 12, 2026 GO-2026-4918 +7 more
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Feb 25, 2026 GO-2026-4918 +7 more
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Feb 9, 2026 GO-2026-4559 +8 more
GO-2026-4559: Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Jan 12, 2026 GO-2026-4918 +7 more
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Dec 8, 2025 GO-2026-4918 +7 more
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Nov 11, 2025 GO-2026-4918 +7 more
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Oct 8, 2025 GO-2026-4918 +7 more
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Oct 7, 2025 GO-2026-4918 +7 more
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Sep 9, 2025 GO-2026-4440 +9 more
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Aug 7, 2025 GO-2026-4440 +9 more
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Jul 10, 2025 GO-2026-4440 +9 more
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Jun 5, 2025 GO-2026-4440 +9 more
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
May 5, 2025 GO-2026-4440 +9 more
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Apr 7, 2025 GO-2026-4440 +9 more
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Mar 27, 2025 GO-2026-4440 +9 more
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Mar 5, 2025 GO-2025-3595 +10 more
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Mar 4, 2025 GO-2025-3595 +10 more
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Feb 10, 2025 GO-2025-3503 +11 more
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Jan 6, 2025 GO-2025-3503 +11 more
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Dec 18, 2024 GO-2025-3503 +11 more
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Dec 4, 2024 GO-2024-3333 +12 more
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Nov 8, 2024 GO-2024-3333 +12 more
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Oct 4, 2024 GO-2024-3333 +12 more
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Sep 5, 2024 GO-2024-3333 +12 more
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Aug 6, 2024 GO-2024-3333 +12 more
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Jul 5, 2024 GO-2024-3333 +12 more
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Jun 4, 2024 GO-2024-3333 +12 more
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
May 6, 2024 GO-2024-3333 +12 more
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Apr 4, 2024 GO-2024-3333 +12 more
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Apr 3, 2024 GO-2024-3333 +12 more
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Mar 4, 2024 GO-2024-2687 +13 more
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Feb 7, 2024 GO-2024-2687 +13 more
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Jan 8, 2024 GO-2024-2687 +13 more
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Nov 27, 2023 GO-2024-2687 +13 more
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Nov 8, 2023 GO-2024-2687 +13 more
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Oct 10, 2023 GO-2024-2687 +13 more
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Oct 5, 2023 GO-2023-2102 +14 more
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Sep 5, 2023 GO-2023-2102 +14 more
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Aug 4, 2023 GO-2023-2102 +14 more
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Aug 1, 2023 GO-2023-2102 +14 more
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Jul 5, 2023 GO-2023-1988 +15 more
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Jun 13, 2023 GO-2023-1988 +15 more
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
May 4, 2023 GO-2023-1988 +15 more
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Apr 6, 2023 GO-2023-1988 +15 more
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Mar 5, 2023 GO-2023-1988 +15 more
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Feb 14, 2023 GO-2023-1988 +15 more
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Feb 8, 2023 GO-2023-1571 +16 more
GO-2023-1571: Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Jan 4, 2023 GO-2023-1571 +16 more
GO-2023-1571: Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Dec 6, 2022 GO-2023-1571 +16 more
GO-2023-1571: Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Dec 6, 2022 GO-2022-1144 +17 more
GO-2022-1144: Excessive memory growth in net/http and golang.org/x/net/http2
GO-2023-1571: Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Nov 7, 2022 GO-2022-1144 +17 more
GO-2022-1144: Excessive memory growth in net/http and golang.org/x/net/http2
GO-2023-1571: Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Oct 19, 2022 GO-2022-1144 +18 more
GO-2022-1144: Excessive memory growth in net/http and golang.org/x/net/http2
GO-2023-1495: Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
GO-2023-1571: Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
GO-2023-1988: Improper rendering of text nodes in golang.org/x/net/html
GO-2023-2102: HTTP/2 rapid reset can cause excessive work in net/http
GO-2024-2687: HTTP/2 CONTINUATION flood in net/http
GO-2024-3333: Non-linear parsing of case-insensitive content in golang.org/x/net/html
GO-2025-3503: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3595: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GO-2026-4440: Quadratic parsing complexity in golang.org/x/net/html
GO-2026-4441: Infinite parsing loop in golang.org/x/net
GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage