{"id":"GO-2022-0197","summary":"Panic when parsing certain inputs in golang.org/x/net/html","details":"The Parse function can panic on some invalid inputs.\n\nFor example, the Parse function panics on the input \"\u003csvg\u003e\u003ctemplate\u003e\u003cdesc\u003e\u003ct\u003e\u003csvg\u003e\u003c/template\u003e\".","aliases":["CVE-2018-17847","CVE-2018-17848","GHSA-4r78-hx75-jjj2","GHSA-mv93-wvcp-7m7r"],"modified":"2026-02-04T04:06:39.203335Z","published":"2022-07-01T20:15:19Z","related":["CGA-r87m-j3pr-78m5"],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2022-0197"},"references":[{"type":"FIX","url":"https://go.dev/cl/159397"},{"type":"FIX","url":"https://go.googlesource.com/net/+/4b62a64f59f73840b9ab79204c94fee61cd1ba2c"},{"type":"REPORT","url":"https://go.dev/issue/27846"}],"affected":[{"package":{"name":"golang.org/x/net","ecosystem":"Go","purl":"pkg:golang/golang.org/x/net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20190125002852-4b62a64f59f7"}]}],"ecosystem_specific":{"imports":[{"symbols":["Parse","ParseFragment","nodeStack.contains"],"path":"golang.org/x/net/html"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2022-0197.json"}}],"schema_version":"1.7.3","credits":[{"name":"@tr3ee"}]}