Is CVE-2026-97045 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97045 being exploited in the wild.

How severe is CVE-2026-97045?

Informational severity, published 27 October 2026.

Which products and versions are affected?

golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.62.0.

Is there a fix for CVE-2026-97045?

Yes. golang.org/x/net (Go): upgrade to 0.62.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97045 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-97045?

Check whether you run Go standard library html package (Go) or golang.org/x/net (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97045: Go html parser namespace handling in childTextNodesAreLiteral

CVE-2026-97045 · Severity: info · Published 2026-10-27

The Go HTML parser has a logic error in how it determines whether to emit text content as literal characters versus parsed content. When HTML is re-parsed after being rendered, certain foster-parented elements in foreign namespaces (like MathML) could be resolved in different namespaces, potentially leading to parsing inconsistencies. This could affect applications that parse and re-parse untrusted HTML content.

Technologies: golang.org/x/net (Go). Vendors: Go.

Quick answers

Is CVE-2026-97045 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97045 being exploited in the wild.
How severe is CVE-2026-97045?: Informational severity, published 27 October 2026.
Which products and versions are affected?: golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.62.0.
Is there a fix for CVE-2026-97045?: Yes. golang.org/x/net (Go): upgrade to 0.62.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97045 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-97045?: Check whether you run Go standard library html package (Go) or golang.org/x/net (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/net (Go): upgrade to 0.62.0 or later
```
go get golang.org/x/net@v0.62.0
```

Technical details

The childTextNodesAreLiteral function in Go's HTML parser incorrectly stops traversing the ancestor chain when it finds an HTML integration point, failing to check whether that integration point itself is a descendant of a foster-parented foreign element. This causes the parser to miss namespace transitions at foster-parented elements like mglyph or malignmark under mtext, resulting in different parsing behavior on re-parsing. The fix requires walking the full ancestor chain and verifying that every namespace transition occurs at an HTML integration point.

Affected products

Go Go standard library html package

Identifiers

CVE-2026-97045
GO-2026-6866

Timeline

2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.