golang.org/x/net (Go)
Advisories
63
Latest version
v0.62.0
Released Oct 27, 2026
License
BSD-3-Clause
OpenSSF Scorecard
—
How to fix
Upgrading to 0.62.0 or later clears every advisory below that has a fix.
Upgrade commands
go
go get golang.org/x/net@v0.62.0 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GO-2026-6860 Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net |
Not rated yet EPSS 0.18% |
< 0.62.0 | 0.62.0 |
| GO-2026-6866 Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net |
Not rated yet EPSS 0.20% |
< 0.62.0 | 0.62.0 |
| GO-2026-6611 Excessive CPU consumption from repeated initial window changes in net/http |
High EPSS 0.61% |
< 0.60.0 | 0.60.0 |
| GO-2026-6603 HTTP/2 server memory exhaustion due to Trailer headers in net/http |
High EPSS 0.63% |
< 0.60.0 | 0.60.0 |
| GO-2026-6617 HTTP/2 server crash due to HPACK encoder race in net/http |
High EPSS 0.49% |
< 0.60.0 | 0.60.0 |
| GO-2026-6612 Double flow control refund on HTTP/2 server streams in net/http |
Critical EPSS 0.62% |
< 0.60.0 | 0.60.0 |
| GO-2026-6610 HTTP/2 transport accepts malformed framing-related headers in net/http |
High EPSS 0.43% |
< 0.60.0 | 0.60.0 |
| GO-2026-5942 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage |
High EPSS 0.55% |
< 0.56.0 | 0.56.0 |
| GHSA-5cv4-jp36-h3mw Go Net HTML parser is vulnerable to denial of service |
Medium EPSS 0.33% |
< 0.55.0 | 0.55.0 |
| GHSA-5cv4-jp36-h3mw Go Net HTML parser is vulnerable to denial of service |
Medium EPSS 0.33% |
< 0.55.0 | 0.55.0 |
| GHSA-5cv4-jp36-h3mw Go Net HTML parser is vulnerable to denial of service |
Medium EPSS 0.33% |
< 0.55.0 | 0.55.0 |
| GO-2026-5025 Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html |
Medium EPSS 0.24% |
< 0.55.0 | 0.55.0 |
| GO-2026-5026 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna |
Critical EPSS 1.83% |
< 0.55.0 | 0.55.0 |
| GO-2026-5027 Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html |
Medium EPSS 0.22% |
< 0.55.0 | 0.55.0 |
| GO-2026-5029 Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html |
Medium EPSS 0.22% |
< 0.55.0 | 0.55.0 |
| GO-2026-5030 Invoking duplicate attributes can cause XSS in golang.org/x/net/html |
Medium EPSS 0.22% |
< 0.55.0 | 0.55.0 |
| GO-2026-4918 Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net |
High EPSS 0.84% |
< 0.53.0 | 0.53.0 |
| GO-2026-4559 Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net |
High EPSS 0.57% |
>= 0.50.0, < 0.51.0 | 0.51.0 |
| GO-2026-4441 Infinite parsing loop in golang.org/x/net |
Medium EPSS 0.55% |
< 0.45.0 | 0.45.0 |
| GO-2026-4440 golang.org/x/net/html has a Quadratic Parsing Complexity issue |
Medium EPSS 0.57% |
< 0.45.0 | 0.45.0 |
| GHSA-vvgc-356p-c3xw golang.org/x/net vulnerable to Cross-site Scripting |
Medium EPSS 0.55% |
< 0.38.0 | 0.38.0 |
| GHSA-vvgc-356p-c3xw golang.org/x/net vulnerable to Cross-site Scripting |
Medium EPSS 0.55% |
< 0.38.0 | 0.38.0 |
| GHSA-vvgc-356p-c3xw golang.org/x/net vulnerable to Cross-site Scripting |
Medium EPSS 0.55% |
< 0.38.0 | 0.38.0 |
| GHSA-qxp5-gwg8-xv66 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net |
Medium EPSS 0.43% |
< 0.36.0 | 0.36.0 |
| GHSA-qxp5-gwg8-xv66 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net |
Medium EPSS 0.43% |
< 0.36.0 | 0.36.0 |
| GHSA-qxp5-gwg8-xv66 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net |
Medium EPSS 0.43% |
< 0.36.0 | 0.36.0 |
| GO-2024-3333 Non-linear parsing of case-insensitive content in golang.org/x/net/html |
Medium EPSS 1.07% |
< 0.33.0 | 0.33.0 |
| GHSA-4v7x-pqxf-cx7m net/http, x/net/http2: close connections when receiving too many headers |
High EPSS 91.97% |
< 0.23.0 | 0.23.0 |
| GHSA-4v7x-pqxf-cx7m net/http, x/net/http2: close connections when receiving too many headers |
High EPSS 91.97% |
< 0.23.0 | 0.23.0 |
| GHSA-4v7x-pqxf-cx7m net/http, x/net/http2: close connections when receiving too many headers |
High EPSS 91.97% |
< 0.23.0 | 0.23.0 |
| GHSA-4374-p667-p6c8 HTTP/2 rapid reset can cause excessive work in net/http Known exploited |
High EPSS 100.00% |
< 0.17.0 | 0.17.0 |
| GHSA-4374-p667-p6c8 HTTP/2 rapid reset can cause excessive work in net/http Known exploited |
High EPSS 100.00% |
< 0.17.0 | 0.17.0 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
< 0.17.0 | 0.17.0 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
< 0.17.0 | 0.17.0 |
| GHSA-2wrh-6pvc-2jm9 Improper rendering of text nodes in golang.org/x/net/html |
Medium EPSS 0.85% |
< 0.13.0 | 0.13.0 |
| GHSA-2wrh-6pvc-2jm9 Improper rendering of text nodes in golang.org/x/net/html |
Medium EPSS 0.85% |
< 0.13.0 | 0.13.0 |
| GHSA-vvpx-j8f3-3w6h golang.org/x/net vulnerable to Uncontrolled Resource Consumption |
High EPSS 4.56% |
< 0.7.0 | 0.7.0 |
| GHSA-vvpx-j8f3-3w6h golang.org/x/net vulnerable to Uncontrolled Resource Consumption |
High EPSS 4.56% |
< 0.7.0 | 0.7.0 |
| GHSA-fxg5-wq6x-vr4w golang.org/x/net/http2/h2c vulnerable to request smuggling attack |
High EPSS 1.82% |
>= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862 | 0.1.1-0.20221104162952-702349b0e862 |
| GHSA-fxg5-wq6x-vr4w golang.org/x/net/http2/h2c vulnerable to request smuggling attack |
High EPSS 1.82% |
>= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862 | 0.1.1-0.20221104162952-702349b0e862 |
| GHSA-xrjj-mj9h-534m golang.org/x/net/http2 vulnerable to possible excessive memory growth |
Medium EPSS 6.08% |
< 0.4.0 | 0.4.0 |
| GHSA-xrjj-mj9h-534m golang.org/x/net/http2 vulnerable to possible excessive memory growth |
Medium EPSS 6.08% |
< 0.4.0 | 0.4.0 |
| GHSA-69cg-p879-7622 golang.org/x/net/http2 Denial of Service vulnerability |
High EPSS 3.49% |
< 0.0.0-20220906165146-f3363e06e74c | 0.0.0-20220906165146-f3363e06e74c |
| GHSA-69cg-p879-7622 golang.org/x/net/http2 Denial of Service vulnerability |
High EPSS 3.49% |
< 0.0.0-20220906165146-f3363e06e74c | 0.0.0-20220906165146-f3363e06e74c |
| GHSA-39qc-96h7-956f golang.org/x/net/http vulnerable to a reset flood |
High EPSS 83.43% |
< 0.0.0-20190813141303-74dc4d7220e7 | 0.0.0-20190813141303-74dc4d7220e7 |
| GHSA-39qc-96h7-956f golang.org/x/net/http vulnerable to a reset flood |
High EPSS 83.43% |
< 0.0.0-20190813141303-74dc4d7220e7 | 0.0.0-20190813141303-74dc4d7220e7 |
| GHSA-39qc-96h7-956f golang.org/x/net/http vulnerable to a reset flood |
High EPSS 83.43% |
< 0.0.0-20190813141303-74dc4d7220e7 | 0.0.0-20190813141303-74dc4d7220e7 |
| GHSA-4r78-hx75-jjj2 golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer |
High EPSS 2.36% |
< 0.0.0-20190125002852-4b62a64f59f7 | 0.0.0-20190125002852-4b62a64f59f7 |
| GHSA-4r78-hx75-jjj2 golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer |
High EPSS 2.36% |
< 0.0.0-20190125002852-4b62a64f59f7 | 0.0.0-20190125002852-4b62a64f59f7 |
| GHSA-4r78-hx75-jjj2 golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer |
High EPSS 2.36% |
< 0.0.0-20190125002852-4b62a64f59f7 | 0.0.0-20190125002852-4b62a64f59f7 |
| GHSA-2wp2-chmh-r934 golang.org/x/net/html NULL Pointer Dereference vulnerability |
High EPSS 2.38% |
< 0.0.0-20180925071336-cf3bd585ca2a | 0.0.0-20180925071336-cf3bd585ca2a |
| GHSA-fcf9-6fv2-fc5v golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer |
High EPSS 2.77% |
< 0.0.0-20180921000356-2f5d2388922f | 0.0.0-20180921000356-2f5d2388922f |
| GHSA-fcf9-6fv2-fc5v golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer |
High EPSS 2.77% |
< 0.0.0-20180921000356-2f5d2388922f | 0.0.0-20180921000356-2f5d2388922f |
| GHSA-2wp2-chmh-r934 golang.org/x/net/html NULL Pointer Dereference vulnerability |
High EPSS 2.38% |
< 0.0.0-20180925071336-cf3bd585ca2a | 0.0.0-20180925071336-cf3bd585ca2a |
| GO-2022-0288 golang.org/x/net/http2 allows uncontrolled memory consumption |
High EPSS 4.25% |
< 0.0.0-20211209124913-491a49abca63 | 0.0.0-20211209124913-491a49abca63 |
| GHSA-h86h-8ppg-mxmh golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion |
Medium EPSS 3.69% |
< 0.0.0-20210428140749-89ef3d95e781 | 0.0.0-20210428140749-89ef3d95e781 |
| GHSA-h86h-8ppg-mxmh golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion |
Medium EPSS 3.69% |
< 0.0.0-20210428140749-89ef3d95e781 | 0.0.0-20210428140749-89ef3d95e781 |
| GHSA-83g2-8m93-v3w7 golang.org/x/net/html Infinite Loop vulnerability |
High EPSS 7.49% |
< 0.0.0-20210520170846-37e1c6afe023 | 0.0.0-20210520170846-37e1c6afe023 |
| GHSA-83g2-8m93-v3w7 golang.org/x/net/html Infinite Loop vulnerability |
High EPSS 7.49% |
< 0.0.0-20210520170846-37e1c6afe023 | 0.0.0-20210520170846-37e1c6afe023 |
| GHSA-5p4h-3377-7w67 golang.org/x/net/html NULL Pointer Dereference vulnerability |
High EPSS 2.77% |
< 0.0.0-20180816102801-aaf60122140d | 0.0.0-20180816102801-aaf60122140d |
| GHSA-vfw5-hrgq-h5wf x/net/html Vulnerable to DoS During HTML Parsing |
High EPSS 2.51% |
< 0.0.0-20190125091013-d26f9f9a57f3 | 0.0.0-20190125091013-d26f9f9a57f3 |
| GHSA-vfw5-hrgq-h5wf x/net/html Vulnerable to DoS During HTML Parsing |
High EPSS 2.51% |
< 0.0.0-20190125091013-d26f9f9a57f3 | 0.0.0-20190125091013-d26f9f9a57f3 |
| GHSA-5p4h-3377-7w67 golang.org/x/net/html NULL Pointer Dereference vulnerability |
High EPSS 2.77% |
< 0.0.0-20180816102801-aaf60122140d | 0.0.0-20180816102801-aaf60122140d |
Source: https://go.googlesource.com/net
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor