CVE-2026-97045 is a cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. The issue arises from improper handling of namespace transitions when walking up the DOM tree, potentially allowing literal text emission in unintended foreign namespaces. This flaw affects versions before 0.62.0 and has been fixed in version 0.62.0.
CVE-2026-78661 is an inefficient algorithmic complexity vulnerability in the golang.org/x/net/html package. The issue occurs when coalescing adjacent text nodes by repeatedly concatenating strings, causing O(n^2) allocations and byte copies for inputs with many short text runs separated by ignored end tags. This inefficiency was fixed in version 0.62.0 by accumulating text in byte slices and converting to strings only once after parsing.
CVE-2026-27136 is a medium severity vulnerability in the golang.org/x/net/html package where parsing arbitrary HTML and rendering it using the Render function can produce an unexpected HTML tree. This behavior may be exploited to perform cross-site scripting (XSS) attacks in applications that rely on this package to sanitize input HTML before rendering. The vulnerability involves improper neutralization of input during web page generation (CWE-79). No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.
CVE-2026-25681 is a medium severity cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. It arises when parsing arbitrary HTML and rendering it with the Render function, which can produce an unexpected HTML tree. This improper neutralization of input during web page generation may allow XSS attacks in applications relying on this package for HTML sanitization. No official patch or remediation guidance is currently available, and no known exploits exist in the wild.
CVE-2026-25680 is a vulnerability in the golang.org/x/net/html package where parsing arbitrary HTML can lead to excessive CPU consumption. This inefficient algorithmic complexity issue can cause denial of service by exhausting system resources. The vulnerability has a CVSS score of 6.5, indicating medium severity. There is no information about an available patch or official remediation at this time. No known exploits are reported in the wild.
CVE-2026-42502 is a medium severity cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. It arises when parsing arbitrary HTML and rendering it with the Render function, which can produce an unexpected HTML tree. This affects applications that sanitize input HTML before rendering, resulting in improper neutralization of input during web page generation. There is no official patch or remediation guidance available yet, and no known exploits have been reported in the wild.
CVE-2026-42506 is a medium severity cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. It occurs when parsing arbitrary HTML and rendering it using the Render function produces an unexpected HTML tree. This improper neutralization of input during web page generation can allow XSS attacks in applications relying on this package for HTML sanitization. No official patch or remediation guidance is currently available. There are no known exploits in the wild at this time.
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.