5.3
Medium
CVE-2024-45338 An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length,…
Description
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/net/html 0.33 | earliest → < 0.33.0 | 0.33.0 |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of golang.org/x/net/html
The 12 CVEs of golang.org/x/net/html →
CVE-2026-78661
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
7.5
High
CVE-2026-97045
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
6.1
Medium
CVE-2026-27136
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
6.1
Medium
CVE-2026-25680
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
6.5
Medium