Skip to content

Security Vulnerability: Go Package: golang.org/x/net <= 0.44.0 - Multiple Remote Denial of Service Vulnerabilities - 0.45.0 #415

@anjaniprayaga

Description

@anjaniprayaga

Describe the bug
golang.org/x/net package used in the latest version <= 0.44.0,
Description:

The parser implements the HTML specification, which contains a number of algorithms which are quadratic in complexity by design. This causes the processing time to scale non-linearly with respect to the size of the input for some HTML documents. We have imposed a depth limit of 512 for nested HTML tags, which should be high enough for the vast majority of valid HTML documents, to address this. [CVE-2025-47911] 2) The parser also misimplemented a portion of the HTML specification for table related tags. This could cause the parser to enter an infinite loop when encountering specific combinations of tags. [CVE-2025-58190] Vendor Affected Components: Go Package: golang.org/x/net: < 0.45.0

To Reproduce
Scan the image, or Please find the snippet attached.

Image

Expected behavior
Update Go Package: golang.org/x/net to version 0.45.0 or later.

Environment:

  • Kubernetes version: NA
  • kubernetes-replicator version: NA

Additional context
NA

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions