CVE-2026-42502Medium· 6.1▾ SunlitInvoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.2%
— → 6.1
none → medium
6.1 → —
medium → none
— → 6.1
none → medium
Last analysed / modified upstream
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
golang.org/x/net < 0.55.0Upgrade to a patched release:
golang.org/x/net 0.55.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56852High· 7.5Infinite loop on invalid input in golang.org/x/text
CVE-2026-97045NoneCheck all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
CVE-2026-27136NoneInvoking duplicate attributes can cause XSS in golang.org/x/net/html
CVE-2026-25681NoneInvoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
CVE-2022-27664High· 7.5golang.org/x/net/http2 Denial of Service vulnerability
CVE-2018-17847High· 7.5golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer