Skip to content

Security Vulnerability: Go Package: golang.org/x/net <= 0.44.0 - Multiple Remote Denial of Service Vulnerabilities - 0.45.0 #391

@anjaniprayaga

Description

@anjaniprayaga

Describe the bug
golang.org/x/net package used in the latest version <= 0.44.0,
Description:

The parser implements the HTML specification, which contains a number of algorithms which are quadratic in complexity by design. This causes the processing time to scale non-linearly with respect to the size of the input for some HTML documents. We have imposed a depth limit of 512 for nested HTML tags, which should be high enough for the vast majority of valid HTML documents, to address this. [CVE-2025-47911] 2) The parser also misimplemented a portion of the HTML specification for table related tags. This could cause the parser to enter an infinite loop when encountering specific combinations of tags. [CVE-2025-58190] Vendor Affected Components: Go Package: golang.org/x/net: < 0.45.0

To Reproduce
Scan the image, or Please find the snippet attached.

Image

Expected behavior
Update Go Package: golang.org/x/net to version 0.45.0 or later.

Kubernetes (please complete the following information):

  • Windows Server version: NA
  • Kubernetes Version: NA
  • CNI: NA

Additional context
NA

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions