Golang.org/x/net Golang.org/x/net/html vulnerabilities

2 CVEs affecting Golang.org/x/net Golang.org/x/net/html, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-22872, published 2025-04-16.

More from Golang.org/x/net.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-45338, published 2024-12-18. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
• CVE-2025-22872, published 2025-04-16. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly…