GO-2021-0078

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2021-0078

Import Source

https://vuln.go.dev/ID/GO-2021-0078.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2021-0078

Aliases

Published

2021-04-14T20:04:52Z

Modified

2024-05-20T16:03:47Z

Summary

Panic when parsing malformed HTML in golang.org/x/net/html

Details

The HTML parser does not properly handle "in frameset" insertion mode, and can be made to panic when operating on malformed HTML that contains tags. If operating on user input, this may be a vector for a denial of service attack.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2021-0078"
}

References

Credits

- Kunpei Sakai

Affected packages

Go / golang.org/x/net

Package

Name: golang.org/x/net; View open source insights on deps.dev
Purl: pkg:golang/golang.org/x/net

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20180816102801-aaf60122140d

Ecosystem specific

{
    "imports": [
        {
            "path": "golang.org/x/net/html",
            "symbols": [
                "Parse",
                "ParseFragment",
                "inBodyIM",
                "inFramesetIM"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2021-0078.json"