VDB
Sign up
MEDIUM5.3

GHSA-w4gw-w5jq-g9jh

golang.org/x/net/html has a Quadratic Parsing Complexity issue

Quick fix

GHSA-w4gw-w5jq-g9jh — golang.org/x/net/html: upgrade to the fixed version with the command below.

go get golang.org/x/net/html@v0.45.0

Details

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to Denial of Service (DoS) if an attacker provides specially crafted HTML content.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/golang.org/x/net/html
Introduced in: 0Fixed in: 0.45.0
Fixgo get golang.org/x/net/html@v0.45.0

References