golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer

Also known as CVE-2018-17848, GHSA-4r78-hx75-jjj2, GHSA-mv93-wvcp-7m7r, GO-2022-0197

Published 8 y ago 2018-10-01 · modified 59 d ago 2026-09-10 · JSON

CVSS

7.5

v3.1 · NVD

CISA KEV

not known exploited

EPSS

2.4%

percentile 84%

Public exploits

none known

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

Exploit prediction (EPSS)

2.36% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:N/A:P`
GitHub	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
GitHub	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`golang.org/x/net`	<0.0.0-20190125002852-4b62a64f59f7	0.0.0-20190125002852-4b62a64f59f7

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-129 Improper Validation of Array Index

References

github.com /golang/go/issues/27846 · x_refsource_MISC, x_transferred
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMV · vendor-advisory, x_refsource_FEDORA, x_transferred
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRA · vendor-advisory, x_refsource_FEDORA, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-17847 · advisory
github.com /golang/go · package
go.dev /cl/159397 · web
go.dev /issue/27846 · web
go.googlesource.com /net/+/4b62a64f59f73840b9ab79204c94fee61cd1ba2c · web
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVC · web
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABT · web
pkg.go.dev /vuln/GO-2022-0197 · web
nvd.nist.gov /vuln/detail/CVE-2018-17848 · advisory

Sources

CVE List: CVE-2018-17847
GitHub Advisory: GHSA-4r78-hx75-jjj2
GitHub Advisory: GHSA-mv93-wvcp-7m7r
NVD: CVE-2018-17847
OSV: GO-2022-0197

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.