Skip to content
OpenAdvisories
Medium · 6.1 CVE-2026-97045 EUVD-2026-111400GHSA-vwcj-r8v9-p53fGO-2026-6866

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

Published Oct 27, 2026 · Updated Nov 4, 2026 · Assigned by Go

Vendor: golang.org/x/net Product: golang.org/x/net/html Package: adsys Package: application-gateway-kubernetes-ingress Package: azl-otel-collector Package: caddy Package: cert-manager Package: cert-manager-1.20 Package: cert-manager-acmesolver-1.20 Package: cert-manager-cainjector-1.20 Package: cert-manager-controller-1.20 Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: cf-cli Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cilium-cli Package: cloud-provider-kubevirt Package: cni-plugins Package: containerd Package: containerd-1 Package: containerd-2 Package: containerd-2.3 Package: containerd-2.4 Package: containerd-shim-runc-v2-1 Package: containerd-shim-runc-v2-2.3 Package: containerd-shim-runc-v2-2.4 Package: containerd-stress-1 Package: containerd-stress-2 Package: containerd-stress-2.3 Package: containerd-stress-2.4 Package: containerized-data-importer Package: cri-o Package: cri-tools Package: ctr-1 Package: ctr-2 Package: ctr-2.4 Package: dasel Package: datadog-agent-7.79 Package: docker-buildx Package: docker-compose Package: dogstatsd-7.78 Package: dogstatsd-7.79 Package: dogstatsd-7.80 Package: dogstatsd-7.81 Package: external-dns-0.21 Package: external-secrets-operator-2.3 Package: falco-no-driver Package: flux-2.10 Package: flux-2.7 Package: flux-2.8 Package: flux-2.9 Package: fuse-overlayfs-snapshotter Package: gh Package: gitea Package: gitlab-agent-19.2 Package: gitlab-kas-19.2 Package: gitlab-pages-19.2 Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.27 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: golang-golang-x-net Package: golang-golang-x-net Package: golang-golang-x-net-dev Package: golang.org/x/net Package: google-guest-agent Package: google-osconfig-agent Package: gpu-feature-discovery Package: grafana-pyroscope-1.19 Package: helm-3 Package: hubble Package: hugo Package: hugo-extended Package: influxdb Package: juju-core Package: k3d Package: k3s-1.32 Package: k3s-1.34 Package: k3s-1.36 Package: k3s-1.37 Package: k3s-multicall-1.32 Package: k3s-static-1.32 Package: k3s-static-1.34 Package: k3s-static-1.35 Package: k3s-static-1.36 Package: k3s-static-1.37 Package: k6 Package: kaf Package: karpenter-1.11 Package: keda Package: kine Package: kots Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-apiserver-1.37 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-controller-manager-1.37 Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-proxy-1.36 Package: kube-proxy-1.37 Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-scheduler-1.36 Package: kube-scheduler-1.37 Package: kube-vip-cloud-provider Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubeadm-1.37 Package: kubectl-1.32 Package: kubectl-1.33 Package: kubectl-1.34 Package: kubectl-1.34-static Package: kubectl-1.35 Package: kubectl-1.36 Package: kubectl-1.37 Package: kubelet-1.34 Package: kubelet-1.34-static Package: kubelet-1.35 Package: kubelet-1.36 Package: kubelet-1.37 Package: kubernetes Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-1.37 Package: kubevirt Package: kubevirt-openvmm Package: kyverno-1.17 Package: kyverno-background-controller-1.17 Package: kyverno-cli-1.17 Package: kyverno-cli-1.18 Package: kyverno-init-container-1.17 Package: kyverno-readiness-checker-1.17 Package: kyverno-readiness-checker-1.18 Package: kyverno-reports-controller-1.17 Package: libcontainers-common Package: loki-3.6-loki-canary Package: loki-3.7 Package: loki-3.7-logcli Package: loki-3.7-loki-canary Package: lxd Package: mailpit Package: minio Package: mps-control-daemon Package: multus Package: nerdctl Package: nvidia-container-toolkit Package: nvidia-device-plugin Package: opentelemetry-collector Package: packer Package: podman Package: prometheus-adapter Package: prometheus-admission-webhook Package: prometheus-config-reloader Package: prometheus-operator Package: rclone Package: runc Package: runc-1.4 Package: snyk-cli Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: sriov-network-device-plugin Package: step Package: step-ca Package: step-issuer Package: telegraf Package: telegraf-1.38 Package: vale Package: wuzz Package: yq Package: zot Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

Affected products

VendorProductAffectedFixed
golang.org/x/net golang.org/x/net/html < 0.62.0 0.62.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-golang-x-net 1:0.62.0-1 —
Debian 13 golang-golang-x-net No fix yet —
Debian 12 golang-golang-x-net No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 adsys +6 No fix yet —
Ubuntu 26.04 LTS adsys +7 No fix yet —
Ubuntu 24.04 LTS adsys +8 No fix yet —
Ubuntu 22.04 LTS adsys +13 No fix yet —
Ubuntu 20.04 LTS lxd +6 No fix yet —
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Ubuntu Pro 26.04 LTS containerd No fix yet —
Ubuntu Pro 24.04 LTS containerd +1 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS adsys +5 No fix yet —
Ubuntu Pro 18.04 LTS lxd +7 No fix yet —
Ubuntu Pro 16.04 LTS lxd +7 No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed amazon-cloudwatch-agent 1.300074.0-1.1 openSUSE-SU-2026:12425-1
openSUSE Tumbleweed google-osconfig-agent 20261103.02-1.1 openSUSE-SU-2026:12430-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-ssm-agent 3.3.5828.0-1.amzn2023 ALAS2023-2026-3428
Amazon Linux 2023 buildah 2:1.43.1-1.amzn2023.0.4 ALAS2023-2026-3451
Amazon Linux 2023 docker 25.0.18-1.amzn2023.0.3 ALAS2023-2026-3391
Amazon Linux 2023 skopeo +1 2:1.22.2-1.amzn2023.0.4 ALAS2023-2026-3450
Amazon Linux 2 amazon-ssm-agent 3.3.5828.0-1.amzn2 ALAS2-2026-4101

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 gh +27 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling caddy 2.11.7-r7 —
Wolfi rolling cert-manager-1.20 +5 1.20.5-r0 —
Wolfi rolling cilium-1.19 +4 1.19.10-r1 —
Wolfi rolling cilium-cli 0.20.1-r5 —
Wolfi rolling containerd-2.3 +2 2.3.7-r4 —
Wolfi rolling ctr-1 +3 1.7.36-r9 —
Wolfi rolling ctr-2 +2 2.4.2-r4 —
Wolfi rolling ctr-2.4 +3 2.4.2-r5 —
Wolfi rolling dogstatsd-7.80 7.80.4-r26 —
Wolfi rolling external-dns-0.21 0.21.0-r31 —
Wolfi rolling falco-no-driver 0.45.1-r2 —
Wolfi rolling flux-2.10 2.10.0-r1 —
Wolfi rolling flux-2.7 2.7.5-r47 —
Wolfi rolling flux-2.8 2.8.8-r30 —
Wolfi rolling flux-2.9 2.9.6-r5 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r33 —
Wolfi rolling gitea 28.2.0-r3 —
Wolfi rolling helm-3 3.22.1-r2 —
Wolfi rolling hubble 1.20.2-r2 —
Wolfi rolling hugo +1 0.169.0-r1 —
Wolfi rolling k3d 5.9.0-r19 —
Wolfi rolling k3s-1.32 +13 No fix yet —
Wolfi rolling k3s-1.34 +1 1.34.12.1-r7 —
Wolfi rolling k3s-1.36 +1 1.36.5.1-r6 —
Wolfi rolling k3s-1.37 +1 1.37.1.1-r5 —
Wolfi rolling k3s-static-1.35 1.35.9.1-r7 —
Wolfi rolling k6 2.3.0-r6 —
Wolfi rolling kaf 0.2.14-r20 —
Wolfi rolling kine 0.17.3-r1 —
Wolfi rolling kots 1.134.1-r1 —
Wolfi rolling kubeadm-1.34 +9 1.34.13-r2 —
Wolfi rolling kubeadm-1.35 +7 1.35.10-r1 —
Wolfi rolling kubeadm-1.36 +4 1.36.6-r0 —
Wolfi rolling kubeadm-1.37 +7 1.37.2-r1 —
Wolfi rolling kubectl-1.33 1.33.13-r16 —
Wolfi rolling kubernetes-1.36 +2 1.36.5-r5 —
Wolfi rolling kyverno-1.17 +5 1.17.2-r44 —
Wolfi rolling kyverno-cli-1.18 +1 1.18.2-r22 —
Wolfi rolling loki-3.6-loki-canary 3.6.19-r1 —
Wolfi rolling loki-3.7 +2 3.7.9-r1 —
Wolfi rolling mailpit 1.33.0-r0 —
Wolfi rolling minio 0.20261023.200651-r2 —
Wolfi rolling mps-control-daemon +2 0.20.1-r6 —
Wolfi rolling nerdctl 2.4.1-r6 —
Wolfi rolling opentelemetry-collector 0.164.0-r1 —
Wolfi rolling prometheus-operator +2 0.94.2-r1 —
Wolfi rolling rclone 1.75.2-r4 —
Wolfi rolling runc 1.5.2-r6 —
Wolfi rolling runc-1.4 1.4.3-r13 —
Wolfi rolling snyk-cli 1.1308.3-r2 —
Wolfi rolling spire-agent +2 1.15.5-r2 —
Wolfi rolling step 0.31.0-r8 —
Wolfi rolling step-ca 0.30.2-r30 —
Wolfi rolling step-issuer 0.12.0-r21 —
Wolfi rolling telegraf-1.38 1.38.4-r37 —
Wolfi rolling vale 3.26.0-r0 —
Wolfi rolling wuzz 0.5.0-r37 —
Wolfi rolling zot 2.1.22-r8 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go golang.org/x/net < 0.62.0 0.62.0 GO-2026-6866

Advisories 7

References