{"schema_version":1,"title":"golang.org/x/net (Go) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 30 vulnerabilities in golang.org/x/net (Go): 0 in the last 7 days and 1 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-46600, was published on 21 July 2026.","url":"https://junglewise.ai/threats/technologies/golang-org-x-net","json_url":"https://junglewise.ai/threats/technologies/golang-org-x-net.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/golang-org-x-net","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":1,"all_time":30,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":1,"last_365_days":11},"latest":[{"cve":"CVE-2026-46600","epss":0.0063,"slug":"cve-2026-46600-google-go-x-net-denial-of-service-in-dnsmessage-parsing","title":"Google Go x/net denial of service in dnsmessage parsing","severity":"info","exploited":false,"published_at":"2026-07-21T20:17:01.213+00:00","url":"https://junglewise.ai/threats/cve-2026-46600-google-go-x-net-denial-of-service-in-dnsmessage-parsing"},{"cve":"CVE-2026-42506","cvss":6.1,"epss":0.0033,"slug":"cve-2026-42506-golang-net-html-cross-site-scripting-via-incorrect-namespaced","title":"Golang net/html Cross-Site Scripting via incorrect namespaced element parsing","severity":"medium","exploited":false,"published_at":"2026-05-22T16:16:20.803+00:00","url":"https://junglewise.ai/threats/cve-2026-42506-golang-net-html-cross-site-scripting-via-incorrect-namespaced"},{"cve":"CVE-2026-42502","cvss":6.1,"epss":0.0022,"slug":"cve-2026-42502-google-go-x-net-html-xss-via-incorrect-foreign-content-parsing","title":"Google Go x/net/html XSS via incorrect foreign content parsing","severity":"medium","exploited":false,"published_at":"2026-05-22T16:16:20.587+00:00","url":"https://junglewise.ai/threats/cve-2026-42502-google-go-x-net-html-xss-via-incorrect-foreign-content-parsing"},{"cve":"CVE-2026-39821","cvss":9.6,"epss":0.0069,"slug":"cve-2026-39821-go-x-net-idna-privilege-escalation-via-punycode-decoding","title":"Go x/net idna privilege escalation via Punycode decoding","severity":"critical","exploited":false,"published_at":"2026-05-22T16:16:20.41+00:00","url":"https://junglewise.ai/threats/cve-2026-39821-go-x-net-idna-privilege-escalation-via-punycode-decoding"},{"cve":"CVE-2026-27136","cvss":6.1,"epss":0.0022,"slug":"cve-2026-27136-golang-x-net-html-xss-via-duplicate-attribute-parsing","title":"Golang x/net/html XSS via duplicate attribute parsing","severity":"medium","exploited":false,"published_at":"2026-05-22T16:16:20.087+00:00","url":"https://junglewise.ai/threats/cve-2026-27136-golang-x-net-html-xss-via-duplicate-attribute-parsing"},{"cve":"CVE-2026-25681","cvss":6.1,"epss":0.0022,"slug":"cve-2026-25681-golang-x-net-html-xss-via-improper-doctype-parsing","title":"Golang x/net/html XSS via improper DOCTYPE parsing","severity":"medium","exploited":false,"published_at":"2026-05-22T16:16:19.863+00:00","url":"https://junglewise.ai/threats/cve-2026-25681-golang-x-net-html-xss-via-improper-doctype-parsing"},{"cve":"CVE-2026-25680","cvss":6.5,"epss":0.0046,"slug":"cve-2026-25680-go-net-html-denial-of-service-in-html-tree-construction","title":"Go net/html denial of service in HTML tree construction","severity":"medium","exploited":false,"published_at":"2026-05-22T16:16:19.753+00:00","url":"https://junglewise.ai/threats/cve-2026-25680-go-net-html-denial-of-service-in-html-tree-construction"},{"cve":"CVE-2026-33814","cvss":7.5,"epss":0.0078,"slug":"cve-2026-33814-go-net-http-infinite-loop-in-http-2-settings-frame-processing","title":"Go net/http infinite loop in HTTP/2 SETTINGS frame processing","severity":"high","exploited":false,"published_at":"2026-05-07T20:16:42.88+00:00","url":"https://junglewise.ai/threats/cve-2026-33814-go-net-http-infinite-loop-in-http-2-settings-frame-processing"},{"cve":"CVE-2026-27141","epss":0.0065,"slug":"cve-2026-27141-go-2026-4559-sending-certain-http-2-frames-can-cause-a-server-to","title":"GO-2026-4559 - Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net","severity":"info","exploited":false,"published_at":"2026-02-26T18:24:17+00:00","url":"https://junglewise.ai/threats/cve-2026-27141-go-2026-4559-sending-certain-http-2-frames-can-cause-a-server-to"},{"cve":"CVE-2025-58190","epss":0.0051,"slug":"cve-2025-58190-go-2026-4441-infinite-parsing-loop-in-golang-org-x-net","title":"GO-2026-4441 - Infinite parsing loop in golang.org/x/net","severity":"info","exploited":false,"published_at":"2026-02-05T17:23:17+00:00","url":"https://junglewise.ai/threats/cve-2025-58190-go-2026-4441-infinite-parsing-loop-in-golang-org-x-net"},{"cve":"CVE-2025-47911","cvss":3.1,"epss":0.0053,"slug":"cve-2025-47911-golang-org-x-net-html-has-a-quadratic-parsing-complexity-issue","title":"GO-2026-4440 - Quadratic parsing complexity in golang.org/x/net/html","severity":"low","exploited":false,"published_at":"2026-02-05T17:23:14+00:00","url":"https://junglewise.ai/threats/cve-2025-47911-golang-org-x-net-html-has-a-quadratic-parsing-complexity-issue"},{"cve":"CVE-2025-22872","cvss":4,"epss":0.0054,"slug":"cve-2025-22872-golang-org-x-net-vulnerable-to-cross-site-scripting","title":"GO-2025-3595 - Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net","severity":"medium","exploited":false,"published_at":"2025-04-16T16:54:55+00:00","url":"https://junglewise.ai/threats/cve-2025-22872-golang-org-x-net-vulnerable-to-cross-site-scripting"},{"cve":"CVE-2025-22870","cvss":4.4,"epss":0.004,"slug":"cve-2025-22870-http-proxy-bypass-using-ipv6-zone-ids-in-golang-org-x-net","title":"HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net","severity":"medium","exploited":false,"published_at":"2025-03-12T22:06:40+00:00","url":"https://junglewise.ai/threats/cve-2025-22870-http-proxy-bypass-using-ipv6-zone-ids-in-golang-org-x-net"},{"cve":"CVE-2024-45338","cvss":4,"epss":0.0087,"slug":"cve-2024-45338-non-linear-parsing-of-case-insensitive-content-in-golang-org-x","title":"GO-2024-3333 - Non-linear parsing of case-insensitive content in golang.org/x/net/html","severity":"medium","exploited":false,"published_at":"2024-12-18T20:22:06+00:00","url":"https://junglewise.ai/threats/cve-2024-45338-non-linear-parsing-of-case-insensitive-content-in-golang-org-x"},{"cve":"CVE-2023-45288","cvss":3.1,"epss":0.9197,"slug":"cve-2023-45288-net-http-x-net-http2-close-connections-when-receiving-too-many","title":"GO-2024-2687 - HTTP/2 CONTINUATION flood in net/http","severity":"low","exploited":false,"published_at":"2024-04-03T21:12:01+00:00","url":"https://junglewise.ai/threats/cve-2023-45288-net-http-x-net-http2-close-connections-when-receiving-too-many"},{"cve":"CVE-2023-39325","cvss":3.1,"epss":0.038,"slug":"cve-2023-39325-http-2-rapid-reset-can-cause-excessive-work-in-net-http","title":"GO-2023-2102 - HTTP/2 rapid reset can cause excessive work in net/http","severity":"low","exploited":false,"published_at":"2023-10-11T16:49:53+00:00","url":"https://junglewise.ai/threats/cve-2023-39325-http-2-rapid-reset-can-cause-excessive-work-in-net-http"},{"cve":"CVE-2023-3978","cvss":3.1,"epss":0.0085,"slug":"cve-2023-3978-improper-rendering-of-text-nodes-in-golang-org-x-net-html","title":"GO-2023-1988 - Improper rendering of text nodes in golang.org/x/net/html","severity":"low","exploited":false,"published_at":"2023-08-02T15:06:27+00:00","url":"https://junglewise.ai/threats/cve-2023-3978-improper-rendering-of-text-nodes-in-golang-org-x-net-html"},{"cve":"CVE-2022-41723","cvss":3.1,"epss":0.0456,"slug":"cve-2022-41723-golang-org-x-net-vulnerable-to-uncontrolled-resource-consumption","title":"GO-2023-1571 - Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net","severity":"low","exploited":false,"published_at":"2023-02-16T22:31:36+00:00","url":"https://junglewise.ai/threats/cve-2022-41723-golang-org-x-net-vulnerable-to-uncontrolled-resource-consumption"},{"cve":"CVE-2022-41721","cvss":3.1,"epss":0.0181,"slug":"cve-2022-41721-golang-org-x-net-http2-h2c-vulnerable-to-request-smuggling-attack","title":"GO-2023-1495 - Request smuggling due to improper request handling in golang.org/x/net/http2/h2c","severity":"low","exploited":false,"published_at":"2023-01-13T22:39:40+00:00","url":"https://junglewise.ai/threats/cve-2022-41721-golang-org-x-net-http2-h2c-vulnerable-to-request-smuggling-attack"},{"cve":"CVE-2022-41717","cvss":3.1,"epss":0.0578,"slug":"cve-2022-41717-golang-org-x-net-http2-vulnerable-to-possible-excessive-memory","title":"GO-2022-1144 - Excessive memory growth in net/http and golang.org/x/net/http2","severity":"low","exploited":false,"published_at":"2022-12-08T19:01:21+00:00","url":"https://junglewise.ai/threats/cve-2022-41717-golang-org-x-net-http2-vulnerable-to-possible-excessive-memory"},{"cve":"CVE-2022-27664","cvss":3.1,"epss":0.0327,"slug":"cve-2022-27664-golang-org-x-net-http2-denial-of-service-vulnerability","title":"GO-2022-0969 - Denial of service in net/http and golang.org/x/net/http2","severity":"low","exploited":false,"published_at":"2022-09-12T20:23:06+00:00","url":"https://junglewise.ai/threats/cve-2022-27664-golang-org-x-net-http2-denial-of-service-vulnerability"},{"cve":"CVE-2019-9512","cvss":3.1,"epss":0.8343,"slug":"cve-2019-9512-golang-org-x-net-http-vulnerable-to-a-reset-flood","title":"GO-2022-0536 - Reset flood in net/http and golang.org/x/net/http","severity":"low","exploited":false,"published_at":"2022-08-01T22:20:53+00:00","url":"https://junglewise.ai/threats/cve-2019-9512-golang-org-x-net-http-vulnerable-to-a-reset-flood"},{"cve":"CVE-2021-44716","cvss":3.1,"epss":0.0396,"slug":"cve-2021-44716-golang-org-x-net-http2-allows-uncontrolled-memory-consumption","title":"GO-2022-0288 - Unbounded memory growth in net/http and golang.org/x/net/http2","severity":"low","exploited":false,"published_at":"2022-07-15T23:08:33+00:00","url":"https://junglewise.ai/threats/cve-2021-44716-golang-org-x-net-http2-allows-uncontrolled-memory-consumption"},{"cve":"CVE-2021-31525","cvss":3.1,"epss":0.0369,"slug":"cve-2021-31525-golang-org-x-net-http-httpguts-vulnerable-to-uncontrolled","title":"GO-2022-0236 - Panic due to large headers in net/http and golang.org/x/net/http/httpguts","severity":"low","exploited":false,"published_at":"2022-07-15T23:04:18+00:00","url":"https://junglewise.ai/threats/cve-2021-31525-golang-org-x-net-http-httpguts-vulnerable-to-uncontrolled"},{"cve":"CVE-2018-17143","cvss":3.1,"epss":0.0277,"slug":"cve-2018-17143-golang-org-x-net-html-has-improper-restriction-of-operations","title":"GO-2022-0193 - Panic on unconsidered isindex and template combination in golang.org/x/net/html","severity":"low","exploited":false,"published_at":"2022-07-06T18:14:54+00:00","url":"https://junglewise.ai/threats/cve-2018-17143-golang-org-x-net-html-has-improper-restriction-of-operations"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"github.com/mattermost/mattermost-server (Go)","slug":"github-com-mattermost-mattermost-server","vulnerabilities":274,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server"},{"name":"github.com/mattermost/mattermost-server/v6 (Go)","slug":"github-com-mattermost-mattermost-server-v6","vulnerabilities":188,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6"},{"name":"github.com/mattermost/mattermost-server/v5 (Go)","slug":"github-com-mattermost-mattermost-server-v5","vulnerabilities":186,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5"},{"name":"github.com/mattermost/mattermost/server/v8 (Go)","slug":"github-com-mattermost-mattermost-server-v8","vulnerabilities":182,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8"},{"name":"stdlib (Go)","slug":"go-stdlib","vulnerabilities":161,"url":"https://junglewise.ai/threats/technologies/go-stdlib"},{"name":"github.com/siyuan-note/siyuan/kernel (Go)","slug":"github-com-siyuan-note-siyuan-kernel","vulnerabilities":158,"url":"https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel"},{"name":"code.gitea.io/gitea (Go)","slug":"code-gitea-io-gitea","vulnerabilities":128,"url":"https://junglewise.ai/threats/technologies/code-gitea-io-gitea"},{"name":"gogs.io/gogs (Go)","slug":"gogs-io-gogs","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/gogs-io-gogs"},{"name":"github.com/traefik/traefik (Go)","slug":"github-com-traefik-traefik","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik"},{"name":"github.com/usememos/memos (Go)","slug":"github-com-usememos-memos","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-usememos-memos"},{"name":"github.com/traefik/traefik/v2 (Go)","slug":"github-com-traefik-traefik-v2","vulnerabilities":73,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2"},{"name":"github.com/traefik/traefik/v3 (Go)","slug":"github-com-traefik-traefik-v3","vulnerabilities":68,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3"}],"technology":{"hub":true,"name":"golang.org/x/net (Go)","slug":"golang-org-x-net","vendor":{"name":"Go","slug":"go","url":"https://junglewise.ai/threats/vendors/go"},"aliases":[],"homepage":"https://pkg.go.dev/golang.org/x/net","repo_url":"https://github.com/golang/net","description":"Go supplementary network libraries including implementations for protocols like IP, ICMP, and HTTP/2.","url":"https://junglewise.ai/threats/technologies/golang-org-x-net"},"most_severe":[{"cve":"CVE-2026-39821","cvss":9.6,"epss":0.0069,"slug":"cve-2026-39821-go-x-net-idna-privilege-escalation-via-punycode-decoding","title":"Go x/net idna privilege escalation via Punycode decoding","severity":"critical","exploited":false,"published_at":"2026-05-22T16:16:20.41+00:00","url":"https://junglewise.ai/threats/cve-2026-39821-go-x-net-idna-privilege-escalation-via-punycode-decoding"},{"cve":"CVE-2026-33814","cvss":7.5,"epss":0.0078,"slug":"cve-2026-33814-go-net-http-infinite-loop-in-http-2-settings-frame-processing","title":"Go net/http infinite loop in HTTP/2 SETTINGS frame processing","severity":"high","exploited":false,"published_at":"2026-05-07T20:16:42.88+00:00","url":"https://junglewise.ai/threats/cve-2026-33814-go-net-http-infinite-loop-in-http-2-settings-frame-processing"},{"cve":"CVE-2026-25680","cvss":6.5,"epss":0.0046,"slug":"cve-2026-25680-go-net-html-denial-of-service-in-html-tree-construction","title":"Go net/html denial of service in HTML tree construction","severity":"medium","exploited":false,"published_at":"2026-05-22T16:16:19.753+00:00","url":"https://junglewise.ai/threats/cve-2026-25680-go-net-html-denial-of-service-in-html-tree-construction"},{"cve":"CVE-2026-42506","cvss":6.1,"epss":0.0033,"slug":"cve-2026-42506-golang-net-html-cross-site-scripting-via-incorrect-namespaced","title":"Golang net/html Cross-Site Scripting via incorrect namespaced element parsing","severity":"medium","exploited":false,"published_at":"2026-05-22T16:16:20.803+00:00","url":"https://junglewise.ai/threats/cve-2026-42506-golang-net-html-cross-site-scripting-via-incorrect-namespaced"},{"cve":"CVE-2026-42502","cvss":6.1,"epss":0.0022,"slug":"cve-2026-42502-google-go-x-net-html-xss-via-incorrect-foreign-content-parsing","title":"Google Go x/net/html XSS via incorrect foreign content parsing","severity":"medium","exploited":false,"published_at":"2026-05-22T16:16:20.587+00:00","url":"https://junglewise.ai/threats/cve-2026-42502-google-go-x-net-html-xss-via-incorrect-foreign-content-parsing"},{"cve":"CVE-2026-27136","cvss":6.1,"epss":0.0022,"slug":"cve-2026-27136-golang-x-net-html-xss-via-duplicate-attribute-parsing","title":"Golang x/net/html XSS via duplicate attribute parsing","severity":"medium","exploited":false,"published_at":"2026-05-22T16:16:20.087+00:00","url":"https://junglewise.ai/threats/cve-2026-27136-golang-x-net-html-xss-via-duplicate-attribute-parsing"},{"cve":"CVE-2026-25681","cvss":6.1,"epss":0.0022,"slug":"cve-2026-25681-golang-x-net-html-xss-via-improper-doctype-parsing","title":"Golang x/net/html XSS via improper DOCTYPE parsing","severity":"medium","exploited":false,"published_at":"2026-05-22T16:16:19.863+00:00","url":"https://junglewise.ai/threats/cve-2026-25681-golang-x-net-html-xss-via-improper-doctype-parsing"},{"cve":"CVE-2025-22870","cvss":4.4,"epss":0.004,"slug":"cve-2025-22870-http-proxy-bypass-using-ipv6-zone-ids-in-golang-org-x-net","title":"HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net","severity":"medium","exploited":false,"published_at":"2025-03-12T22:06:40+00:00","url":"https://junglewise.ai/threats/cve-2025-22870-http-proxy-bypass-using-ipv6-zone-ids-in-golang-org-x-net"},{"cve":"CVE-2024-45338","cvss":4,"epss":0.0087,"slug":"cve-2024-45338-non-linear-parsing-of-case-insensitive-content-in-golang-org-x","title":"GO-2024-3333 - Non-linear parsing of case-insensitive content in golang.org/x/net/html","severity":"medium","exploited":false,"published_at":"2024-12-18T20:22:06+00:00","url":"https://junglewise.ai/threats/cve-2024-45338-non-linear-parsing-of-case-insensitive-content-in-golang-org-x"},{"cve":"CVE-2025-22872","cvss":4,"epss":0.0054,"slug":"cve-2025-22872-golang-org-x-net-vulnerable-to-cross-site-scripting","title":"GO-2025-3595 - Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net","severity":"medium","exploited":false,"published_at":"2025-04-16T16:54:55+00:00","url":"https://junglewise.ai/threats/cve-2025-22872-golang-org-x-net-vulnerable-to-cross-site-scripting"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}