Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
Priority LOW 27CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 7 fixed, 60 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-79.
Summary
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Partial golang.org/x/net/html (golang.org/x/net): 0.55.0Red Hat: 8 advisoriesRed Hat: 7 fixed, 60 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | golang.org/x/net/html | before 0.55.0 | 0.55.0 | Patch available | CNA |
- golang.org/x/net/html VendorGo standard library Affected before 0.55.0 Fixed in 0.55.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:net:*:*:*:*:*:go:*:* | before 0.55.0 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:net:*:*:*:*:*:go:*:* Versions before 0.55.0 Vulnerable ·Go standard library
Remediation
- Fix · CNA golang.org/x/net/html (golang.org/x/net) Fixed in 0.55.0
Red Hat 8 advisories
- RHSA-2026:91249 Released 2026-10-27 · Red Hat rating CriticalRed Hat AI Base Images 3.5.5 (Neuron)
- Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-neuron-rhel9
- RHSA-2026:91248 Released 2026-10-27 · Red Hat rating CriticalRed Hat AI Base Images 3.4.6 (Neuron)
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
- RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
Show 5 more Red Hat advisories
- RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Importantmulticluster engine for Kubernetes v2.11.5 security update
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
- RHSA-2026:43692 Released 2026-07-22 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.6 registry.redhat.io/oadp/oadp-velero-rhel9
- RHSA-2026:37387 Released 2026-07-09 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
- RHSA-2026:34342 Released 2026-07-01 · Red Hat rating CriticalCluster Observability Operator 1.5.0
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
golang.org/x/net/html 0.55.0
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2026-20765 Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/htmlPriority LOW 29
- TI-2026-30785 Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlPriority LOW 27
- TI-2026-21586 Invoking duplicate attributes can cause XSS in golang.org/x/net/htmlPriority LOW 27
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix yet: Fix deferred |
| Builds for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| External Secrets Operator for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Fence Agents Remediation Operator | Affected | No fix yet: Fix deferred |
| File Integrity Operator | Affected | No fix yet: Fix deferred |
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Logical Volume Manager Storage | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Multiarch Tuning Operator | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| OpenShift API for Data Protection | Affected | No fix yet: Fix deferred |
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 5 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Lightspeed for Runtimes Operator | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Cluster Manager CLI | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Workspaces Operator | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift for Windows Containers | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Service Interconnect 2 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Security Profiles Operator | Affected | No fix yet: Fix deferred |
| Zero Trust Workload Identity Manager | Affected | No fix yet: Fix deferred |
| Zero Trust Workload Identity Manager - Tech Preview | Affected | No fix yet: Fix deferred |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Cert Manager support for Red Hat OpenShift release 1.17 | Fixed | RHSA-2026:82304, RHSA-2026:82322 |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:34342 |
| OpenShift API for Data Protection 1.6 | Fixed | RHSA-2026:43692 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:91248 |
| Red Hat OpenShift AI 3.5 | Fixed | RHSA-2026:91249 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:37387 |
| multicluster engine for Kubernetes 2.11 | Fixed | RHSA-2026:57194 |
Not affected: 14 products
- Cluster Observability Operator 1.5
- Compliance Operator
- Multicluster Engine for Kubernetes
- OpenShift API for Data Protection 1.6
- OpenShift Lightspeed
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Virtualization 4
- Red Hat OpenShift on AWS
- Red Hat Openshift Data Foundation 4.22
- multicluster engine for Kubernetes 2.11
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42506
- 2026-10-03 Alias added: GHSA-cg87-vwwh-xvgj
- 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
- 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:91248 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:91249 · Red Hat
- 2026-10-30 Fix available: Red Hat OpenShift AI 3.4, Red Hat OpenShift AI 3.5 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-06 Fix available: Cluster Observability Operator 1.5 · Red Hat
References
More Go standard library Net vulnerabilities
- TI-2026-28703 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna CVSS 3.1CRITICAL 9.6
- TI-2018-12685 The html package (aka x/net/html) through 2018-09-25 in Go mishandles… CVSS 3.1HIGH 7.5
- TI-2018-12250 The html package (aka x/net/html) through 2018-09-17 in Go mishandles… CVSS 3.1HIGH 7.5
- TI-2018-12206 The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset"… CVSS 3.1HIGH 7.5
- TI-2018-12687 The html package (aka x/net/html) through 2018-09-25 in Go mishandles… CVSS 3.1HIGH 7.5
- TI-2018-12686 The html package (aka x/net/html) through 2018-09-25 in Go mishandles… CVSS 3.1HIGH 7.5
Sources
- CVE-2026-42506 · CVE Program
- CVE-2026-42506 · NVD
- FIRST EPSS
- GHSA-cg87-vwwh-xvgj · GitHub Advisory Database · CC BY 4.0
- CVE-2026-42506 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences