--- id: CVE-2026-42502 aliases: - GO-2026-5027 title: >- Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html summary: >- Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html severity: medium cvss: 6.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N' vendor: x product: golang.org/x/net ecosystem: go affected: - golang.org/x/net < 0.55.0 patched: - golang.org/x/net 0.55.0 published: '2026-05-22' updated: '2026-09-22' sourceUpdated: '2026-09-22T10:41:48.597564594Z' source: OSV sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5027' references: - url: 'https://go.dev/issue/79572' - url: 'https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8' - url: 'https://go.dev/cl/781701' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42502.json - url: 'https://access.redhat.com/security/cve/CVE-2026-42502' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2480762' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-42502' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42502' - url: 'https://pkg.go.dev/vuln/GO-2026-5027' - url: 'https://access.redhat.com/errata/RHSA-2026:67517' - url: 'https://access.redhat.com/errata/RHSA-2026:63134' - url: 'https://access.redhat.com/errata/RHSA-2026:67139' - url: 'https://access.redhat.com/errata/RHSA-2026:66432' - url: 'https://access.redhat.com/errata/RHSA-2026:61585' - url: 'https://access.redhat.com/errata/RHSA-2026:59562' - url: 'https://access.redhat.com/errata/RHSA-2026:51112' - url: 'https://access.redhat.com/errata/RHSA-2026:59560' - url: 'https://access.redhat.com/errata/RHSA-2026:67138' - url: 'https://access.redhat.com/errata/RHSA-2026:54527' - url: 'https://access.redhat.com/errata/RHSA-2026:54531' - url: 'https://access.redhat.com/errata/RHSA-2026:56340' - url: 'https://access.redhat.com/errata/RHSA-2026:59467' - url: 'https://access.redhat.com/errata/RHSA-2026:66022' - url: 'https://access.redhat.com/errata/RHSA-2026:43692' - url: 'https://access.redhat.com/errata/RHSA-2026:54288' - url: 'https://access.redhat.com/errata/RHSA-2026:60387' - url: 'https://access.redhat.com/errata/RHSA-2026:60390' - url: 'https://access.redhat.com/errata/RHSA-2026:60388' - url: 'https://access.redhat.com/errata/RHSA-2026:54427' - url: 'https://access.redhat.com/errata/RHSA-2026:57191' - url: 'https://access.redhat.com/errata/RHSA-2026:60391' - url: 'https://access.redhat.com/errata/RHSA-2026:60386' - url: 'https://access.redhat.com/errata/RHSA-2026:63016' - url: 'https://access.redhat.com/errata/RHSA-2026:26546' - url: 'https://access.redhat.com/errata/RHSA-2026:36319' - url: 'https://access.redhat.com/errata/RHSA-2026:26547' tags: - osv - go - csaf - vex - red-hat epss: 0.00223 epssPercentile: 0.11562 cvssSource: vendor cwe: - CWE-79 ingestedAt: '2026-08-26T19:27:02.637Z' --- ## Overview Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. ## Affected packages - `golang.org/x/net < 0.55.0` ## Remediation Upgrade to a patched release: - `golang.org/x/net 0.55.0` ## Vendor advisories - **RHSA-2026:67517** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67517) - **RHSA-2026:63134** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63134) - **RHSA-2026:67139** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67139) - **RHSA-2026:66432** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:66432) - **RHSA-2026:61585** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61585) - **RHSA-2026:59562** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59562) - **RHSA-2026:51112** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51112) - **RHSA-2026:59560** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59560) - **RHSA-2026:67138** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67138) - **RHSA-2026:54527** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54527) - **RHSA-2026:54531** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54531) - **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Fence Agents Remediation Operator, File Integrity Operator, … · no fix planned: Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, Zero Trust Workload Identity Manager - Tech Preview, Assisted Installer for Red Hat OpenShift Container Platform 2, … · updated 2026-09-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42502.json) - **RHSA-2026:56340** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.5 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56340) - **RHSA-2026:59467** · Red Hat · fixed in: OpenShift API for Data Protection 1.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59467) - **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022) - **RHSA-2026:43692** · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43692) - **RHSA-2026:54288** · Red Hat · fixed in: OpenShift File Integrity Operator - FIO 1 · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54288) - **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387)