GHSA-2wp2-chmh-r934 CVE-2018-17142 GO-2022-0192

golang.org/x/net/html NULL Pointer Dereference vulnerability

High Go

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 2.38%; Chance of exploitation in the next 30 days. Higher than 83.87% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-476 NULL Pointer Dereference
Fix: 0.0.0-20180925071336-cf3bd585ca2a; Upgrade golang.org/x/net to this version or later

Description

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call

Affected versions

Go

Package	Vulnerable	Fixed in
golang.org/x/net	`< 0.0.0-20180925071336-cf3bd585ca2a`	`0.0.0-20180925071336-cf3bd585ca2a`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

golang.org/x/net Go → `0.0.0-20180925071336-cf3bd585ca2a`

go

go get golang.org/x/net@v0.0.0-20180925071336-cf3bd585ca2a && go mod tidy

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-476: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How to prevent it

Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Requirements: Select a programming language that is not susceptible to these issues.
Implementation: Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Implementation: Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2018-17142

Packages

github.com/golang/go

Timeline

May 13, 2022 Published
May 20, 2024 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-4374-p667-p6c8 HTTP/2 rapid reset can cause excessive work in net/http	High Known exploited	Also affects golang.org/x/net
GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack	Medium Known exploited	Also affects golang.org/x/net
GO-2026-6866 Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net	Not rated yet	Also affects golang.org/x/net
GO-2026-6860 Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net	Not rated yet	Also affects golang.org/x/net
GO-2026-6617 HTTP/2 server crash due to HPACK encoder race in net/http	High	Also affects golang.org/x/net
GO-2026-6612 Double flow control refund on HTTP/2 server streams in net/http	Critical	Also affects golang.org/x/net
GO-2026-6611 Excessive CPU consumption from repeated initial window changes in net/http	High	Also affects golang.org/x/net
GO-2026-6610 HTTP/2 transport accepts malformed framing-related headers in net/http	High	Also affects golang.org/x/net

Credits: @tr3ee

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor