Go Net HTML parser is vulnerable to denial of service

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-25680 · ADVISORY
• go.dev/cl/781702 · WEB
• go.dev/issue/79573 · WEB
• go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472 · WEB
• go.googlesource.com/net/+/refs/tags/v0.55.0 · WEB
• groups.google.com/g/golang-announce/c/iI-mYSI0lu8 · WEB
• pkg.go.dev/vuln/GO-2026-5028 · WEB
• cs.opensource.google/go/x/net · PACKAGE

golang.org/x/net のその他の脆弱性

• CVE-2026-97045In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found…
• CVE-2026-78661When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data +…
• CVE-2026-97032高 7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies…
• CVE-2026-78669高 7.5A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending ma…
• CVE-2026-78663緊急 9.1The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for a…