Golang.org/x/net vulnerabilities
We track 10 vulnerabilities in Golang.org/x/net products across 4 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Golang.org/x/net vulnerabilities
- 7.5 High severity
golang.org/x/net/html: Inefficient Algorithmic Complexity
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated b
- 7.5 High severity
net/http: Concurrent Execution using Shared Resource with Improper Synchronization
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part o
- 7.5 High severity
net/http: Asymmetric Resource Consumption (Amplification)
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
- 9.1 Critical severity
net/http: Multiple Operations on Resource in Single-Operation Context
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client
- 7.5 High severity
net/http: Inconsistent Interpretation of HTTP Requests
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers
- 7.5 High severity
net/http: Asymmetric Resource Consumption (Amplification)
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a maliciou
- 8.2 High severity
net/http: Improper Validation of Unsafe Equivalence in Input
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege e
- 7.5 High severity
golang.org/x/net/http2: Loop with Unreachable Exit Condition
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
- 7.5 High severity
net/http: Allocation of Resources Without Limits or Throttling
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress reque
- 7.5 High severity
golang.org/x/net/http2/h2c: Inconsistent Interpretation of HTTP Requests
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP