VDB
Sign up
HIGH

GHSA-w32m-9786-jp63

Non-linear parsing of case-insensitive content in golang.org/x/net/html

Quick fix

GHSA-w32m-9786-jp63 — golang.org/x/net/html: upgrade to the fixed version with the command below.

go get golang.org/x/net/html@v0.33.0

Details

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/golang.org/x/net/html
Introduced in: 0Fixed in: 0.33.0
Fixgo get golang.org/x/net/html@v0.33.0

References