Denial of Service (DoS) Affecting golang.org/x/net/html package, versions <0.0.0-20190125002852-4b62a64f59f7
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.3% (71st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GOLANGORGXNETHTML-3314983
- published 8 Feb 2023
- disclosed 13 May 2022
- credit Unknown
Introduced: 13 May 2022
CVE-2018-17847 Open this link in a new tabHow to fix?
Upgrade golang.org/x/net/html to version 0.0.0-20190125002852-4b62a64f59f7 or higher.
Overview
golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.
Affected versions of this package are vulnerable to Denial of Service (DoS) in node.go, which mishandles namespace changes when parsing. Certain invalid inputs can cause a panic and crash.
PoC
package main
import (
"strings"
"golang.org/x/net/html"
)
func main() {
r := strings.NewReader("<svg><template><desc><t><svg></template>")
html.Parse(r)
}
CVSS Scores
version 3.1