| CVE-2026-97045 | — | In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext | 27/10/2026 |
| CVE-2026-78661 | — | When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocatio | 27/10/2026 |
| CVE-2026-97032 | ÉLEVÉE7.5 | HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the enc | 08/10/2026 |
| CVE-2026-78669 | ÉLEVÉE7.5 | A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. | 08/10/2026 |
| CVE-2026-78663 | CRITIQUE9.1 | The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level f | 08/10/2026 |
| CVE-2026-78660 | ÉLEVÉE7.5 | Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the | 08/10/2026 |
| CVE-2026-78659 | ÉLEVÉE7.5 | When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that | 08/10/2026 |
| CVE-2026-46600 | ÉLEVÉE7.5 | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. | 21/07/2026 |
| CVE-2026-42506 | MOYENNE6.1 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | 22/05/2026 |
| CVE-2026-42502 | MOYENNE6.1 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | 22/05/2026 |
| CVE-2026-39821 | CRITIQUE9.6 | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a | 22/05/2026 |
| CVE-2026-27136 | MOYENNE6.1 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | 22/05/2026 |
| CVE-2026-25681 | MOYENNE6.1 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | 22/05/2026 |
| CVE-2026-25680 | MOYENNE6.5 | Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. | 22/05/2026 |
| CVE-2026-33814 | ÉLEVÉE7.5 | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. | 07/05/2026 |
| CVE-2026-27141 | ÉLEVÉE7.5 | Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic | 26/02/2026 |
| CVE-2025-58190 | MOYENNE5.3 | The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | 05/02/2026 |
| CVE-2025-47911 | MOYENNE5.3 | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | 05/02/2026 |
| CVE-2025-22872 | MOYENNE6.5 | The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as bein | 16/04/2025 |
| CVE-2025-22870 | MOYENNE4.4 | Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied. | 12/03/2025 |