How many golang.org/x/net golang.org/x/net/html CVEs are in CISA KEV?

None of golang.org/x/net golang.org/x/net/html's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of golang.org/x/net golang.org/x/net/html are affected?

10 distinct golang.org/x/net golang.org/x/net/html versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in golang.org/x/net golang.org/x/net/html CVEs?

golang.org/x/net golang.org/x/net/html's CVEs most often map to these CWE weakness types: CWE-1333 (Inefficient Regular Expression Complexity).

What is the average severity of golang.org/x/net golang.org/x/net/html CVEs?

The average CVSS base score across golang.org/x/net golang.org/x/net/html's scored CVEs is 6.2.

golang.org/x/net golang.org/x/net/html Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: golang.org/x/net golang.org/x/net/html vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

golang.org/x/net golang.org/x/net/html Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

golang.org/x/net golang.org/x/net/html has 10 published CVE records since 2023, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 6.2.

This page aggregates every publicly disclosed vulnerability (CVE) affecting golang.org/x/net golang.org/x/net/html, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of golang.org/x/net golang.org/x/net/html's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High1

Medium9

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of golang.org/x/net golang.org/x/net/html's CVEs are currently listed in CISA's KEV catalog.

Public exploits

No golang.org/x/net golang.org/x/net/html CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every golang.org/x/net golang.org/x/net/html version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 0.55.05 CVEs
< 0.45.02 CVEs
< 0.13.01 CVE
< 0.33.01 CVE
< 0.38.01 CVE

Fixed in

0.55.05 CVEs
0.45.02 CVEs
0.13.01 CVE
0.33.01 CVE
0.38.01 CVE

Find a version

10 CVEs

Sort

Invoking duplicate attributes can cause XSS in golang.org/x/net/html
CVE-2026-27136
Patch
Medium · CVSS 6.1
EPSS 0.2% (13th pct)2026-05-22
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
CVE-2026-25681
Patch
Medium · CVSS 6.1
EPSS 0.2% (13th pct)2026-05-22
Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
CVE-2026-25680
Patch
Medium · CVSS 6.5
EPSS 0.3% (25th pct)2026-05-22
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
CVE-2026-42502
Patch
Medium · CVSS 6.1
EPSS 0.2% (13th pct)2026-05-22
Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
CVE-2026-42506
Patch
Medium · CVSS 6.1
EPSS 0.2% (14th pct)2026-05-22
Infinite parsing loop in golang.org/x/net
CVE-2025-58190
Patch
Medium · CVSS 5.3
EPSS 0.5% (40th pct)2026-02-05
Quadratic parsing complexity in golang.org/x/net/html
CVE-2025-47911
Patch
Medium · CVSS 5.3
EPSS 0.5% (41th pct)2026-02-05
Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
CVE-2025-22872
Patch
Medium · CVSS 5.3
EPSS 0.5% (42th pct)2025-04-16
Non-linear parsing of case-insensitive content in golang.org/x/net/html
CVE-2024-45338
Patch
CWE-1333
High · CVSS 8.7
EPSS 0.9% (56th pct)2024-12-18
Medium vulnerability · 2023-08-02
CVE-2023-3978
Patch
Medium · CVSS 6.1
EPSS 0.9% (56th pct)2023-08-02

Common weakness types

The CWE weakness categories most often found in golang.org/x/net golang.org/x/net/html CVEs. Follow any weakness for its full explanation.

CWE-1333Inefficient Regular Expression Complexity1 CVE

Disclosure activity by year

How many golang.org/x/net golang.org/x/net/html CVEs were published each year.

2023

2024

2025

2026

Other golang.org/x/net products

Browse vulnerabilities for other products by golang.org/x/net.

golang.org/x/net/http26 CVEs golang.org/x/net/dns/dnsmessage1 CVEs golang.org/x/net/http2/h2c1 CVEs golang.org/x/net/http2/hpack1 CVEs golang.org/x/net/http/httpproxy1 CVEs golang.org/x/net/idna1 CVEs golang.org/x/net/proxy1 CVEs

Frequently asked questions

Common questions about golang.org/x/net golang.org/x/net/html vulnerabilities.

How many CVEs does golang.org/x/net golang.org/x/net/html have?: golang.org/x/net golang.org/x/net/html has 10 published CVE records since 2023.
How many golang.org/x/net golang.org/x/net/html CVEs are in CISA KEV?: None of golang.org/x/net golang.org/x/net/html's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for golang.org/x/net golang.org/x/net/html vulnerabilities?: No golang.org/x/net golang.org/x/net/html CVEs currently have a tracked public exploit in this dataset.
Which versions of golang.org/x/net golang.org/x/net/html are affected?: 10 distinct golang.org/x/net golang.org/x/net/html versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in golang.org/x/net golang.org/x/net/html CVEs?: golang.org/x/net golang.org/x/net/html's CVEs most often map to these CWE weakness types: CWE-1333 (Inefficient Regular Expression Complexity).
What is the average severity of golang.org/x/net golang.org/x/net/html CVEs?: The average CVSS base score across golang.org/x/net golang.org/x/net/html's scored CVEs is 6.2.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track golang.org/x/net golang.org/x/net/html vulnerabilities

Monitor new golang.org/x/net golang.org/x/net/html vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing