CVE-2018-17075: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days.

The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit.

Affected products

• Fedoraproject Fedora: version 28 only; version 29 only
• Golang Net: up to and including 2018-07-12

Published 2018-09-16. Last modified 2026-06-17.