{"id":"CVE-2026-42502","aliases":["GO-2026-5027"],"title":"Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html","summary":"Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","vendor":"x","product":"golang.org/x/net","ecosystem":"go","affected":["golang.org/x/net < 0.55.0"],"patched":["golang.org/x/net 0.55.0"],"published":"2026-05-22","updated":"2026-09-22","sourceUpdated":"2026-09-22T10:41:48.597564594Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5027","references":[{"url":"https://go.dev/issue/79572"},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"},{"url":"https://go.dev/cl/781701"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42502.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-42502"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480762"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42502"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42502"},{"url":"https://pkg.go.dev/vuln/GO-2026-5027"},{"url":"https://access.redhat.com/errata/RHSA-2026:67517"},{"url":"https://access.redhat.com/errata/RHSA-2026:63134"},{"url":"https://access.redhat.com/errata/RHSA-2026:67139"},{"url":"https://access.redhat.com/errata/RHSA-2026:66432"},{"url":"https://access.redhat.com/errata/RHSA-2026:61585"},{"url":"https://access.redhat.com/errata/RHSA-2026:59562"},{"url":"https://access.redhat.com/errata/RHSA-2026:51112"},{"url":"https://access.redhat.com/errata/RHSA-2026:59560"},{"url":"https://access.redhat.com/errata/RHSA-2026:67138"},{"url":"https://access.redhat.com/errata/RHSA-2026:54527"},{"url":"https://access.redhat.com/errata/RHSA-2026:54531"},{"url":"https://access.redhat.com/errata/RHSA-2026:56340"},{"url":"https://access.redhat.com/errata/RHSA-2026:59467"},{"url":"https://access.redhat.com/errata/RHSA-2026:66022"},{"url":"https://access.redhat.com/errata/RHSA-2026:43692"},{"url":"https://access.redhat.com/errata/RHSA-2026:54288"},{"url":"https://access.redhat.com/errata/RHSA-2026:60387"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"url":"https://access.redhat.com/errata/RHSA-2026:54427"},{"url":"https://access.redhat.com/errata/RHSA-2026:57191"},{"url":"https://access.redhat.com/errata/RHSA-2026:60391"},{"url":"https://access.redhat.com/errata/RHSA-2026:60386"},{"url":"https://access.redhat.com/errata/RHSA-2026:63016"},{"url":"https://access.redhat.com/errata/RHSA-2026:26546"},{"url":"https://access.redhat.com/errata/RHSA-2026:36319"},{"url":"https://access.redhat.com/errata/RHSA-2026:26547"}],"tags":["osv","go","csaf","vex","red-hat"],"epss":0.00223,"epssPercentile":0.13197,"cvssSource":"vendor","cwe":["CWE-79"],"ingestedAt":"2026-08-26T19:27:02.637Z","slug":"CVE-2026-42502","body":"## Overview\n\nParsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.\n\n## Affected packages\n\n- `golang.org/x/net < 0.55.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `golang.org/x/net 0.55.0`\n\n## Vendor advisories\n\n- **RHSA-2026:67517** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67517)\n- **RHSA-2026:63134** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63134)\n- **RHSA-2026:67139** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67139)\n- **RHSA-2026:66432** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:66432)\n- **RHSA-2026:61585** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61585)\n- **RHSA-2026:59562** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59562)\n- **RHSA-2026:51112** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51112)\n- **RHSA-2026:59560** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59560)\n- **RHSA-2026:67138** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67138)\n- **RHSA-2026:54527** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54527)\n- **RHSA-2026:54531** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54531)\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Fence Agents Remediation Operator, File Integrity Operator, … · no fix planned: Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, Zero Trust Workload Identity Manager - Tech Preview, Assisted Installer for Red Hat OpenShift Container Platform 2, … · updated 2026-09-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42502.json)\n- **RHSA-2026:56340** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.5 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56340)\n- **RHSA-2026:59467** · Red Hat · fixed in: OpenShift API for Data Protection 1.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59467)\n- **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022)\n- **RHSA-2026:43692** · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43692)\n- **RHSA-2026:54288** · Red Hat · fixed in: OpenShift File Integrity Operator - FIO 1 · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54288)\n- **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387)","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":5200,"id":"CVE-2026-42502","ts":1788887253522,"field":"cvss","old":null,"new":"6.1"},{"seq":5199,"id":"CVE-2026-42502","ts":1788887253522,"field":"severity","old":"none","new":"medium"},{"seq":4083,"id":"CVE-2026-42502","ts":1788886369370,"field":"cvss","old":"6.1","new":null},{"seq":4082,"id":"CVE-2026-42502","ts":1788886369370,"field":"severity","old":"medium","new":"none"},{"seq":3173,"id":"CVE-2026-42502","ts":1788883133223,"field":"cvss","old":null,"new":"6.1"},{"seq":3172,"id":"CVE-2026-42502","ts":1788883133223,"field":"severity","old":"none","new":"medium"}]}