Summary
It was discovered that Go Networking did not properly handle server
errors after sending a GOAWAY frame during HTTP/2 connection shutdown,
which could cause the connection to hang. A remote attacker could
possibly use this issue to cause a denial of service. (CVE-2022-27664)
It was discovered that Go Networking had quadratic complexity when
decoding HPACK headers in HTTP/2 streams. A remote attacker could
possibly use this issue to cause Go Networking to use excessive
resources, leading to a denial of service. (CVE-2022-41723)
It was discovered that Go Networking incorrectly rendered text nodes
outside of the HTML namespace literally, causing text that should be
escaped to not be escaped. A remote attacker could possibly use this
issue to perform cross-site scripting attacks. (CVE-2023-3978)
Guido Vranken discovered that Go Networking processed certain inputs to
the HTML parsing functions non-linearly with respect to their length. A
remote attacker could possibly use this issue to cause Go Networking to
use excessive resources, leading to a denial of service.
(CVE-2024-45338)
Sean Ng discovered that Go Networking incorrectly interpreted tags in
foreign content with unquoted attribute values ending with a solidus
character as self-closing, which could result in content being placed
in the wrong scope during DOM construction. A remote attacker could
possibly use this issue to perform cross-site scripting attacks.
(CVE-2025-22872)
It was discovered that Go Networking had quadratic parsing complexity
when processing certain HTML inputs. A remote attacker could possibly
use this issue to cause Go Networking to use excessive resources,
leading to a denial of service. (CVE-2025-47911)
It was discovered that Go Networking could enter an infinite loop when
parsing certain HTML inputs. A remote attacker could possibly use this
issue to cause Go Networking to use excessive resources, leading to a
denial of service. (CVE-2025-58190)
It was discovered that Go Networking incorrectly accepted
Punycode-encoded labels that decoded to ASCII-only labels when
processing internationalized domain names. A remote attacker could
possibly use this issue to bypass access control restrictions and
escalate privileges. (CVE-2026-39821)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | golang-golang-x-net | 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1 |
Vulnerabilities 8
-
Critical 9.6
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …
-
High 7.5
golang.org/x/net/http2 Denial of Service vulnerability
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
-
High 7.5
Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
-
Medium 6.5
Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse func…
-
Medium 6.1
Improper rendering of text nodes in golang.org/x/net/html
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
-
Medium 5.3
Non-linear parsing of case-insensitive content in golang.org/x/net/html
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
-
Medium 5.3
Quadratic parsing complexity in golang.org/x/net/html
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
-
Medium 5.3
Infinite parsing loop in golang.org/x/net
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
References
-
report
https://ubuntu.com/security/CVE-2022-27664
-
report
https://ubuntu.com/security/CVE-2022-41723
-
report
https://ubuntu.com/security/CVE-2023-3978
-
report
https://ubuntu.com/security/CVE-2024-45338
-
report
https://ubuntu.com/security/CVE-2025-22872
-
report
https://ubuntu.com/security/CVE-2025-47911
-
report
https://ubuntu.com/security/CVE-2025-58190
-
report
https://ubuntu.com/security/CVE-2026-39821