Threat database

CVE-2026-27136 is a medium severity vulnerability in the golang.org/x/net/html package where parsing arbitrary HTML and rendering it using the Render function can produce an unexpected HTML tree. This behavior may be exploited to perform cross-site scripting (XSS) attacks in applications that rely on this package to sanitize input HTML before rendering. The vulnerability involves improper neutralization of input during web page generation (CWE-79). No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

CVE-2026-25681 is a medium severity cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. It arises when parsing arbitrary HTML and rendering it with the Render function, which can produce an unexpected HTML tree. This improper neutralization of input during web page generation may allow XSS attacks in applications relying on this package for HTML sanitization. No official patch or remediation guidance is currently available, and no known exploits exist in the wild.

CVE-2026-25680 is a vulnerability in the golang.org/x/net/html package where parsing arbitrary HTML can lead to excessive CPU consumption. This inefficient algorithmic complexity issue can cause denial of service by exhausting system resources. The vulnerability has a CVSS score of 6.5, indicating medium severity. There is no information about an available patch or official remediation at this time. No known exploits are reported in the wild.

CVE-2026-42502 is a medium severity cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. It arises when parsing arbitrary HTML and rendering it with the Render function, which can produce an unexpected HTML tree. This affects applications that sanitize input HTML before rendering, resulting in improper neutralization of input during web page generation. There is no official patch or remediation guidance available yet, and no known exploits have been reported in the wild.

CVE-2026-42506 is a medium severity cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. It occurs when parsing arbitrary HTML and rendering it using the Render function produces an unexpected HTML tree. This improper neutralization of input during web page generation can allow XSS attacks in applications relying on this package for HTML sanitization. No official patch or remediation guidance is currently available. There are no known exploits in the wild at this time.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

EPSS 0.6%Vulnerabilitygolang.org/x/net#cwe-476United States+9

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

EPSS 0.5%Vulnerabilitygolang.org/x/net#cwe-835Germany+5

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

EPSS 0.6%Vulnerabilitygolang.org/x/net#cwe-400Germany+5