Improper rendering of text nodes in golang.org/x/net/html
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 11 fixed, 22 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00851 58th percentileScored 2026-11-07
Fix Partial golang.org/x/net/html (golang.org/x/net): 0.13.0golang.org/x/net (Go): 0.13.0Red Hat: 18 advisoriesRed Hat: 11 fixed, 22 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | golang.org/x/net/html | before 0.13.0 | 0.13.0 | Patch available | CNA |
| — | golang.org/x/net (Go) | before 0.13.0 | 0.13.0 | Patch available | GHSA-2wrh-6pvc-2jm9 |
- golang.org/x/net/html VendorGo standard library Affected before 0.13.0 Fixed in 0.13.0 Patch available CNA
- golang.org/x/net (Go) Vendor— Affected before 0.13.0 Fixed in 0.13.0 Patch available GHSA-2wrh-6pvc-2jm9
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:* | before 0.13.0 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:* Versions before 0.13.0 Vulnerable ·Go standard library
Remediation
- Fix · CNA golang.org/x/net/html (golang.org/x/net) Fixed in 0.13.0
- Fix · GHSA-2wrh-6pvc-2jm9 golang.org/x/net (Go) Fixed in 0.13.0 Advisory →
Red Hat 18 advisories
- RHSA-2024:10523 Released 2024-12-05 · Red Hat rating ImportantOpenShift Container Platform 4.14.42 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-nutanix-cloud-controller-manager-rhel8, openshift4/ose-nutanix-machine-controllers-rhel8
- RHSA-2024:1891 Released 2024-04-26 · Red Hat rating ImportantOpenShift Container Platform 4.14.22 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
- RHSA-2024:0944 Released 2024-02-28 · Red Hat rating ModerateOpenShift Container Platform 4.14.14 packages and security update
- Red Hat OpenShift Container Platform 4.14 podman-3:4.4.1-11.2.rhaos4.14.el8, podman-3:4.4.1-11.2.rhaos4.14.el9, podman-catatonit-3:4.4.1-11.2.rhaos4.14.el8 +10
Show 15 more Red Hat advisories
- RHSA-2023:7198 Released 2024-02-27 · Red Hat rating CriticalOpenShift Container Platform 4.15.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
- RHSA-2023:7197 Released 2024-02-27 · Red Hat rating CriticalOpenShift Container Platform 4.15.0 security and extras update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-ansible-operator, openshift4/ose-clusterresourceoverride-rhel9, openshift4/ose-clusterresourceoverride-rhel9-operator +7
- RHSA-2024:0485 Released 2024-01-31 · Red Hat rating ImportantOpenShift Container Platform 4.12.48 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2023:7315 Released 2023-11-21 · Red Hat rating ImportantOpenShift Container Platform 4.14.3 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-container-networking-plugins-rhel8, openshift4/ose-gcp-cluster-api-controllers-rhel8, openshift4/ose-k8s-prometheus-adapter +4
- RHSA-2023:6837 Released 2023-11-15 · Red Hat rating ImportantOpenShift Container Platform 4.14.2 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/oc-mirror-plugin-rhel8, openshift4/openshift-route-controller-manager-rhel8, openshift4/ose-aws-cloud-controller-manager-rhel8 +44
- RHSA-2023:7216 Released 2023-11-15 · Red Hat rating ModerateRed Hat OpenShift Service Mesh Containers for 2.4.5
- RHOSSM 2.4 for RHEL 8 openshift-service-mesh/istio-cni-rhel8
- RHSA-2023:6939 Released 2023-11-14 · Red Hat rating Moderatecontainer-tools:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.s390x::container-tools:rhel8 +47
- RHSA-2023:6938 Released 2023-11-14 · Red Hat rating Moderatecontainer-tools:4.0 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.s390x::container-tools:4.0 +47
- RHSA-2023:6832 Released 2023-11-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.14.0 security, enhancement & bug fix update
- RHODF 4.14 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-cli-rhel9, odf4/mcg-core-rhel9 +12
- RHSA-2023:6474 Released 2023-11-07 · Red Hat rating Moderatepodman security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.6.1-5.el9, podman-docker-2:4.6.1-5.el9, podman-gvproxy-2:4.6.1-5.el9 +3
- RHSA-2023:5009 Released 2023-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.14.0 security update
- Ironic content for Red Hat OpenShift Container Platform 4.14 openstack-ironic-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-api-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-common-1:21.5.0-0.20231002130534.0df5961.el9 +47
- Red Hat OpenShift Container Platform 4.14 afterburn-5.4.3-1.rhaos4.14.el9, afterburn-dracut-5.4.3-1.rhaos4.14.el9, bpftool-7.0.0-284.36.1.el9_2 +47
- RHSA-2023:5007 Released 2023-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.14.0 security update
- Red Hat OpenShift Container Platform 4.14 openshift-tech-preview/metallb-rhel8, openshift4/cloud-event-proxy-rhel8, openshift4/frr-rhel9 +47
- RHSA-2023:5006 Released 2023-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.14.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
- RHSA-2023:6031 Released 2023-10-23 · Red Hat rating ImportantCryostat security update
- Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
- RHSA-2023:5888 Released 2023-10-19 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.13 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-hook-runner-rhel8, rhmtc/openshift-migration-legacy-rhel8-operator +14
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift API for Data Protection | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix planned: Out of support scope |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix planned: Out of support scope |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Self Node Remediation Operator | Affected | No fix yet |
| 8Base-MTV-2.4 | Fixed | — |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:5888 |
| Cryostat 2 on RHEL 8 | Fixed | RHSA-2023:6031 |
| LVMS 4.14 for RHEL 9 | Fixed | — |
| RHODF 4.14 for RHEL 9 | Fixed | RHSA-2023:6832 |
| RHOSSM 2.4 for RHEL 8 | Fixed | RHSA-2023:7216 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:6938, RHSA-2023:6939 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:6474 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2024:0485 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2023:5006, RHSA-2023:5007, RHSA-2023:5009, RHSA-2023:6837, RHSA-2023:7315, RHSA-2024:0944, RHSA-2024:10523, RHSA-2024:1891 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2023:7197, RHSA-2023:7198 |
Not affected: 14 products
- 8Base-MTV-2.4
- Cryostat 2 on RHEL 8
- Ironic content for Red Hat OpenShift Container Platform 4.14
- Logging Subsystem for Red Hat OpenShift
- RHODF 4.14 for RHEL 9
- RHOSSM 2.4 for RHEL 8
- Red Hat Advanced Cluster Security 4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform Assisted Installer 1
- Red Hat OpenStack Platform 18.0
- cert-manager Operator for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3978
- 2026-10-03 Alias added: GHSA-2wrh-6pvc-2jm9
References
More Go standard library Networking vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2023-3978 · CVE Program
- CVE-2023-3978 · NVD
- FIRST EPSS
- GHSA-2wrh-6pvc-2jm9 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-3978 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences