Описание
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| golang-golang-x-net | fixed | 1:0.47.0-1 | package | |
| golang-golang-x-net | no-dsa | trixie | package | |
| golang-golang-x-net | no-dsa | bookworm | package | |
| golang-golang-x-net | postponed | bullseye | package |
Примечания
https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c
https://github.com/golang/go/issues/75682
Fixed by: https://github.com/golang/net/commit/59706cdaa8f95502fdec64b67b4c61d6ca58727d (v0.45.0)
Связанные уязвимости
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
golang.org/x/net/html has a Quadratic Parsing Complexity issue
Уязвимость пакета golang-x-net языка программирования Golang, связанная с недостаточным контролем ресурса в период его существования, позволяющая нарушителю вызвать отказ в обслуживании