# golang.org/x/net (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/golang-org-x-net Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/golang-org-x-net.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 33 vulnerabilities in golang.org/x/net (Go): 0 in the last 7 days and 2 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-97045, was published on 27 October 2026. 2 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 2 - All time: 33 (2 critical, 1 exploited in the wild) ## About golang.org/x/net (Go) Go package providing low-level networking primitives for protocol implementation and network operations. ## Latest golang.org/x/net (Go) vulnerabilities - [CVE-2026-97045: Go html parser namespace handling in childTextNodesAreLiteral](https://junglewise.ai/threats/cve-2026-97045-in-childtextnodesareliteral-walking-up-the-tree-previously) (info, published 27 Oct 2026) - [CVE-2026-78661: Go HTML parser quadratic time complexity in text node coalescing](https://junglewise.ai/threats/cve-2026-78661-when-coalescing-adjacent-text-nodes-in-addtext-and-fosterparent) (info, published 27 Oct 2026) - [CVE-2026-46600: Google Go x/net denial of service in dnsmessage parsing](https://junglewise.ai/threats/cve-2026-46600-google-go-x-net-denial-of-service-in-dnsmessage-parsing) (info, published 21 Jul 2026) - [CVE-2026-42506: Golang net/html Cross-Site Scripting via incorrect namespaced element parsing](https://junglewise.ai/threats/cve-2026-42506-golang-net-html-cross-site-scripting-via-incorrect-namespaced) (medium, CVSS 6.1, published 22 May 2026) - [CVE-2026-42502: Google Go x/net/html XSS via incorrect foreign content parsing](https://junglewise.ai/threats/cve-2026-42502-google-go-x-net-html-xss-via-incorrect-foreign-content-parsing) (medium, CVSS 6.1, published 22 May 2026) - [CVE-2026-39821: Go x/net idna privilege escalation via Punycode decoding](https://junglewise.ai/threats/cve-2026-39821-go-x-net-idna-privilege-escalation-via-punycode-decoding) (critical, CVSS 9.6, published 22 May 2026) - [CVE-2026-27136: Golang x/net/html XSS via duplicate attribute parsing](https://junglewise.ai/threats/cve-2026-27136-golang-x-net-html-xss-via-duplicate-attribute-parsing) (medium, CVSS 6.1, published 22 May 2026) - [CVE-2026-25681: Golang x/net/html XSS via improper DOCTYPE parsing](https://junglewise.ai/threats/cve-2026-25681-golang-x-net-html-xss-via-improper-doctype-parsing) (medium, CVSS 6.1, published 22 May 2026) - [CVE-2026-25680: Go net/html denial of service in HTML tree construction](https://junglewise.ai/threats/cve-2026-25680-go-net-html-denial-of-service-in-html-tree-construction) (medium, CVSS 6.5, published 22 May 2026) - [CVE-2026-33814: Go net/http infinite loop in HTTP/2 SETTINGS frame processing](https://junglewise.ai/threats/cve-2026-33814-go-net-http-infinite-loop-in-http-2-settings-frame-processing) (high, CVSS 7.5, published 7 May 2026) - [CVE-2026-27141: GO-2026-4559 - Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net](https://junglewise.ai/threats/cve-2026-27141-go-2026-4559-sending-certain-http-2-frames-can-cause-a-server-to) (info, published 26 Feb 2026) - [CVE-2025-58190: GO-2026-4441 - Infinite parsing loop in golang.org/x/net](https://junglewise.ai/threats/cve-2025-58190-go-2026-4441-infinite-parsing-loop-in-golang-org-x-net) (info, published 5 Feb 2026) - [CVE-2025-47911: GO-2026-4440 - Quadratic parsing complexity in golang.org/x/net/html](https://junglewise.ai/threats/cve-2025-47911-golang-org-x-net-html-has-a-quadratic-parsing-complexity-issue) (low, CVSS 3.1, published 5 Feb 2026) - [CVE-2025-22872: GO-2025-3595 - Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net](https://junglewise.ai/threats/cve-2025-22872-golang-org-x-net-vulnerable-to-cross-site-scripting) (medium, CVSS 4, published 16 Apr 2025) - [CVE-2025-22870: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net](https://junglewise.ai/threats/cve-2025-22870-http-proxy-bypass-using-ipv6-zone-ids-in-golang-org-x-net) (medium, CVSS 4.4, published 12 Mar 2025) - [CVE-2024-45338: GO-2024-3333 - Non-linear parsing of case-insensitive content in golang.org/x/net/html](https://junglewise.ai/threats/cve-2024-45338-non-linear-parsing-of-case-insensitive-content-in-golang-org-x) (medium, CVSS 4, published 18 Dec 2024) - [CVE-2023-45288: GO-2024-2687 - HTTP/2 CONTINUATION flood in net/http](https://junglewise.ai/threats/cve-2023-45288-net-http-x-net-http2-close-connections-when-receiving-too-many) (low, CVSS 3.1, published 3 Apr 2024) - [CVE-2023-39325: GO-2023-2102 - HTTP/2 rapid reset can cause excessive work in net/http](https://junglewise.ai/threats/cve-2023-39325-http-2-rapid-reset-can-cause-excessive-work-in-net-http) (low, CVSS 3.1, published 11 Oct 2023) - [CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attack](https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 10 Oct 2023) - [CVE-2023-3978: GO-2023-1988 - Improper rendering of text nodes in golang.org/x/net/html](https://junglewise.ai/threats/cve-2023-3978-improper-rendering-of-text-nodes-in-golang-org-x-net-html) (low, CVSS 3.1, published 2 Aug 2023) - [CVE-2022-41723: GO-2023-1571 - Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net](https://junglewise.ai/threats/cve-2022-41723-golang-org-x-net-vulnerable-to-uncontrolled-resource-consumption) (low, CVSS 3.1, published 16 Feb 2023) - [CVE-2022-41721: GO-2023-1495 - Request smuggling due to improper request handling in golang.org/x/net/http2/h2c](https://junglewise.ai/threats/cve-2022-41721-golang-org-x-net-http2-h2c-vulnerable-to-request-smuggling-attack) (low, CVSS 3.1, published 13 Jan 2023) - [CVE-2022-41717: GO-2022-1144 - Excessive memory growth in net/http and golang.org/x/net/http2](https://junglewise.ai/threats/cve-2022-41717-golang-org-x-net-http2-vulnerable-to-possible-excessive-memory) (low, CVSS 3.1, published 8 Dec 2022) - [CVE-2022-27664: GO-2022-0969 - Denial of service in net/http and golang.org/x/net/http2](https://junglewise.ai/threats/cve-2022-27664-golang-org-x-net-http2-denial-of-service-vulnerability) (low, CVSS 3.1, published 12 Sep 2022) - [CVE-2019-9512: GO-2022-0536 - Reset flood in net/http and golang.org/x/net/http](https://junglewise.ai/threats/cve-2019-9512-golang-org-x-net-http-vulnerable-to-a-reset-flood) (low, CVSS 3.1, published 1 Aug 2022) ## Most severe golang.org/x/net (Go) vulnerabilities - [CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attack](https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 10 Oct 2023) - [CVE-2026-39821: Go x/net idna privilege escalation via Punycode decoding](https://junglewise.ai/threats/cve-2026-39821-go-x-net-idna-privilege-escalation-via-punycode-decoding) (critical, CVSS 9.6, published 22 May 2026) - [CVE-2026-33814: Go net/http infinite loop in HTTP/2 SETTINGS frame processing](https://junglewise.ai/threats/cve-2026-33814-go-net-http-infinite-loop-in-http-2-settings-frame-processing) (high, CVSS 7.5, published 7 May 2026) - [CVE-2026-25680: Go net/html denial of service in HTML tree construction](https://junglewise.ai/threats/cve-2026-25680-go-net-html-denial-of-service-in-html-tree-construction) (medium, CVSS 6.5, published 22 May 2026) - [CVE-2026-42506: Golang net/html Cross-Site Scripting via incorrect namespaced element parsing](https://junglewise.ai/threats/cve-2026-42506-golang-net-html-cross-site-scripting-via-incorrect-namespaced) (medium, CVSS 6.1, published 22 May 2026) - [CVE-2026-42502: Google Go x/net/html XSS via incorrect foreign content parsing](https://junglewise.ai/threats/cve-2026-42502-google-go-x-net-html-xss-via-incorrect-foreign-content-parsing) (medium, CVSS 6.1, published 22 May 2026) - [CVE-2026-27136: Golang x/net/html XSS via duplicate attribute parsing](https://junglewise.ai/threats/cve-2026-27136-golang-x-net-html-xss-via-duplicate-attribute-parsing) (medium, CVSS 6.1, published 22 May 2026) - [CVE-2026-25681: Golang x/net/html XSS via improper DOCTYPE parsing](https://junglewise.ai/threats/cve-2026-25681-golang-x-net-html-xss-via-improper-doctype-parsing) (medium, CVSS 6.1, published 22 May 2026) - [CVE-2025-22870: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net](https://junglewise.ai/threats/cve-2025-22870-http-proxy-bypass-using-ipv6-zone-ids-in-golang-org-x-net) (medium, CVSS 4.4, published 12 Mar 2025) - [CVE-2024-45338: GO-2024-3333 - Non-linear parsing of case-insensitive content in golang.org/x/net/html](https://junglewise.ai/threats/cve-2024-45338-non-linear-parsing-of-case-insensitive-content-in-golang-org-x) (medium, CVSS 4, published 18 Dec 2024) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "golang.org/x/net (Go) vulnerabilities", https://junglewise.ai/threats/technologies/golang-org-x-net, 13 November 2026.