GO
Vendor
golang.org/x/net
19
CVEs
0
On KEV
7
New 30D
Products
GO9.1
golang.org/x/net/http2
golang.org/x/net
7 CVEs0 on KEV5 new
GO6.5
golang.org/x/net/html
golang.org/x/net
10 CVEs0 on KEV2 new
GO7.5
golang.org/x/net/dns/dnsmessage
golang.org/x/net
1 CVEs0 on KEV0 new
GO9.6
golang.org/x/net/idna
golang.org/x/net
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-97045 New | GO golang.org/x/net/html golang.org/x/net | – | Oct 27 | Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net |
| CVE-2026-78661 New | GO golang.org/x/net/html golang.org/x/net | – | Oct 27 | Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net |
| CVE-2026-97032 | GO golang.org/x/net/http2 golang.org/x/net | 7.5 | Oct 8 | HTTP/2 server crash due to HPACK encoder race in net/http |
| CVE-2026-78663 | GO golang.org/x/net/http2 golang.org/x/net | 9.1 | Oct 8 | Double flow control refund on HTTP/2 server streams in net/http |
| CVE-2026-78669 | GO golang.org/x/net/http2 golang.org/x/net | 7.5 | Oct 8 | Excessive CPU consumption from repeated initial window changes in net/http |
| CVE-2026-78660 | GO golang.org/x/net/http2 golang.org/x/net | 7.5 | Oct 8 | HTTP/2 transport accepts malformed framing-related headers in net/http |
| CVE-2026-78659 | GO golang.org/x/net/http2 golang.org/x/net | 7.5 | Oct 8 | HTTP/2 server memory exhaustion due to Trailer headers in net/http |
| CVE-2026-46600 | GO golang.org/x/net/dns/dnsmessage golang.org/x/net | 7.5 | Jul 21 | Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage |
| CVE-2026-27136 | GO golang.org/x/net/html golang.org/x/net | 6.1 | May 22 | Invoking duplicate attributes can cause XSS in golang.org/x/net/html |
| CVE-2026-25681 | GO golang.org/x/net/html golang.org/x/net | 6.1 | May 22 | Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html |
| CVE-2026-25680 | GO golang.org/x/net/html golang.org/x/net | 6.5 | May 22 | Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html |
| CVE-2026-42502 | GO golang.org/x/net/html golang.org/x/net | 6.1 | May 22 | Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html |
| CVE-2026-39821 | GO golang.org/x/net/idna golang.org/x/net | 9.6 | May 22 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna |
| CVE-2026-42506 | GO golang.org/x/net/html golang.org/x/net | 6.1 | May 22 | Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html |
| CVE-2026-33814 | GO golang.org/x/net/http2 golang.org/x/net | 7.5 | May 7 | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net |
| CVE-2026-27141 | GO golang.org/x/net/http2 golang.org/x/net | 7.5 | Feb 26 | Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net |
| CVE-2025-58190 | GO golang.org/x/net/html golang.org/x/net | 5.3 | Feb 5 | Infinite parsing loop in golang.org/x/net |
| CVE-2025-47911 | GO golang.org/x/net/html golang.org/x/net | 5.3 | Feb 5 | Quadratic parsing complexity in golang.org/x/net/html |
| CVE-2024-45338 | GO golang.org/x/net/html golang.org/x/net | 5.3 | Dec 18 | Non-linear parsing of case-insensitive content in golang.org/x/net/html |