CVE-2026-42502Medium· 6.1▾ Sunlit

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score34/ 100 · Low

impact 33.6 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 22, 2026

Updated

Sep 20, 2026

CVSS

6.1

Vendor

Red Hat

Product

Red Hat Openshift Data Foundation 4.22

CWE

CWE-79

Depth score

34 · Low

EPSS

0.22% · p13

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Aug 26.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

9 events · 121 days

May 22, 2026Published
Disclosed via CSAF
Aug 26, 2026EPSS first tracked
0.2%
Sep 8, 2026CVSS changed
— → 6.1
Sep 8, 2026Severity changed
none → medium
Sep 8, 2026CVSS changed
6.1 → —
Sep 8, 2026Severity changed
medium → none
Sep 8, 2026CVSS changed
— → 6.1
Sep 8, 2026Severity changed
none → medium
Sep 20, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-79 #csaf #vex #red-hat #osv #go

Affected

Patched in

enterprise_linux_appstream_eus_v_10_0
enterprise_linux_appstream_v_10
enterprise_linux_appstream_e4s_v_9_2
enterprise_linux_appstream_e4s_v_9_4
enterprise_linux_appstream_eus_v_9_6
enterprise_linux_appstream_v_9
cert_manager_support_for_red_hat_openshift_release 1.19
logging_subsystem_for_red_hat_openshift 6.5
openshift_api_for_data_protection 1.4
openshift_api_for_data_protection 1.5
openshift_api_for_data_protection 1.6
openshift_file_integrity_operator_fio 1
advanced_cluster_management_for_kubernetes 2.11
advanced_cluster_management_for_kubernetes 2.13
advanced_cluster_management_for_kubernetes 2.14
advanced_cluster_management_for_kubernetes 2.15
advanced_cluster_management_for_kubernetes 2.16
advanced_cluster_management_for_kubernetes 2.17
advanced_cluster_security 4.9
advanced_cluster_security_for_kubernetes 4.10
advanced_cluster_security_for_kubernetes 4.11
lightspeed_formerly_insights_for_runtimes 1.0
openshift_ai 2.25
openshift_ai 3.4
openshift_distributed_tracing 3.11.1
openshift_data_foundation 4.22
satellite 6.18
multicluster_engine_for_kubernetes 2.11
multicluster_engine_for_kubernetes 2.6
multicluster_engine_for_kubernetes 2.8
multicluster_engine_for_kubernetes 2.9

Full technical detail▾

Overview

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user's web browser, potentially compromising user data or taking control of their session.

Vendor advisories

RHSA-2026:67517 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-15 · advisory
RHSA-2026:63134 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-03 · advisory
RHSA-2026:67139 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-14 · advisory
RHSA-2026:66432 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-11 · advisory
RHSA-2026:61585 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-08-31 · advisory
RHSA-2026:59562 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-25 · advisory
RHSA-2026:51112 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-06 · advisory
RHSA-2026:59560 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-25 · advisory
RHSA-2026:67138 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-14 · advisory
RHSA-2026:54527 · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-08-13 · advisory
RHSA-2026:54531 · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-08-13 · advisory
Red Hat VEX · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Fence Agents Remediation Operator, File Integrity Operator, … · no fix planned: Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, Zero Trust Workload Identity Manager - Tech Preview, Assisted Installer for Red Hat OpenShift Container Platform 2, … · updated 2026-09-20 · vex
RHSA-2026:56340 · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.5 · released 2026-08-18 · advisory
RHSA-2026:59467 · Red Hat · fixed in: OpenShift API for Data Protection 1.4 · released 2026-08-25 · advisory
RHSA-2026:66022 · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · advisory
RHSA-2026:43692 · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · advisory
RHSA-2026:54288 · Red Hat · fixed in: OpenShift File Integrity Operator - FIO 1 · released 2026-08-12 · advisory
RHSA-2026:60387 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · advisory

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering — rated Moderate by Red Hat. Released 2026-05-22, updated 2026-09-20.

Affected:

Assisted Installer for Red Hat OpenShift Container Platform 2
cert-manager Operator for Red Hat OpenShift
Compliance Operator
Confidential Compute Attestation
Fence Agents Remediation Operator
File Integrity Operator
Logging Subsystem for Red Hat OpenShift
Logical Volume Manager Storage
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Multicluster Engine for Kubernetes
Multicluster Global Hub
Node HealthCheck Operator
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
Red Hat 3scale API Management Platform 2
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 5
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Red Hat Connectivity Link 1
Red Hat Edge Manager 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Hardened Images
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Cluster Manager CLI
Red Hat OpenShift Container Platform 4
Red Hat OpenShift Dev Spaces
Red Hat OpenShift Dev Workspaces Operator
Red Hat OpenShift distributed tracing 3
Red Hat OpenShift GitOps
Red Hat OpenShift on AWS
Red Hat OpenShift Virtualization 4
Red Hat OpenStack Platform 16.2

Fixed:

Red Hat Enterprise Linux AppStream EUS (v. 10.0)
Red Hat Enterprise Linux AppStream (v. 10)
Red Hat Enterprise Linux AppStream E4S (v.9.2)
Red Hat Enterprise Linux AppStream E4S (v.9.4)
Red Hat Enterprise Linux AppStream EUS (v.9.6)
Red Hat Enterprise Linux AppStream (v. 9)
Cert Manager support for Red Hat OpenShift release 1.19
Logging Subsystem for Red Hat OpenShift 6.5
OpenShift API for Data Protection 1.4
OpenShift API for Data Protection 1.5
OpenShift API for Data Protection 1.6
OpenShift File Integrity Operator - FIO 1
Red Hat Advanced Cluster Management for Kubernetes 2.11
Red Hat Advanced Cluster Management for Kubernetes 2.13
Red Hat Advanced Cluster Management for Kubernetes 2.14
Red Hat Advanced Cluster Management for Kubernetes 2.15
Red Hat Advanced Cluster Management for Kubernetes 2.16
Red Hat Advanced Cluster Management for Kubernetes 2.17
Red Hat Advanced Cluster Security 4.9
Red Hat Advanced Cluster Security for Kubernetes 4.10
Red Hat Advanced Cluster Security for Kubernetes 4.11
Red Hat Lightspeed (formerly Insights) for Runtimes 1.0
Red Hat OpenShift AI 2.25
Red Hat OpenShift AI 3.4
Red Hat OpenShift distributed tracing 3.11.1
Red Hat Openshift Data Foundation 4.22
Red Hat Satellite 6.18
multicluster engine for Kubernetes 2.11
multicluster engine for Kubernetes 2.6
multicluster engine for Kubernetes 2.8
multicluster engine for Kubernetes 2.9

No fix planned:

Red Hat Hardened Images
Red Hat OpenShift Container Platform 4
Zero Trust Workload Identity Manager - Tech Preview
Assisted Installer for Red Hat OpenShift Container Platform 2
cert-manager Operator for Red Hat OpenShift
Compliance Operator
Confidential Compute Attestation
Fence Agents Remediation Operator
File Integrity Operator
Logging Subsystem for Red Hat OpenShift
Logical Volume Manager Storage
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Multicluster Engine for Kubernetes
Multicluster Global Hub
Node HealthCheck Operator
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
Red Hat 3scale API Management Platform 2
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 5
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Red Hat Connectivity Link 1
Red Hat Edge Manager 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Cluster Manager CLI
Red Hat OpenShift Dev Spaces
Red Hat OpenShift Dev Workspaces Operator
Red Hat OpenShift distributed tracing 3
Red Hat OpenShift GitOps
Red Hat OpenShift on AWS
Red Hat OpenShift Virtualization 4

Not affected:

Logging Subsystem for Red Hat OpenShift 6.5
OpenShift API for Data Protection 1.4
OpenShift API for Data Protection 1.5
OpenShift API for Data Protection 1.6
OpenShift File Integrity Operator - FIO 1
Red Hat Advanced Cluster Management for Kubernetes 2.11
Red Hat Advanced Cluster Management for Kubernetes 2.13
Red Hat Advanced Cluster Management for Kubernetes 2.14
Red Hat Advanced Cluster Management for Kubernetes 2.15
Red Hat Advanced Cluster Management for Kubernetes 2.16

Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67517 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:63134 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67139

Workarounds / mitigations:

Applications utilizing golang.org/x/net/html should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.

Package advisory (CVE-2026-42502)

Affected packages:

golang.org/x/net < 0.55.0

Patched in:

golang.org/x/net 0.55.0

Source: https://osv.dev/vulnerability/GO-2026-5027

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026CVSS — → 6.1
Sep 8, 2026Severity none → medium
Sep 8, 2026CVSS 6.1 → —
Sep 8, 2026Severity medium → none
Sep 8, 2026CVSS — → 6.1
Sep 8, 2026Severity none → medium

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#go

← Back to feed