CVE-2018-17846: High severity go (golang) vulnerability
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.
Other sources
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-17846.
What is the severity of CVE-2018-17846?
The severity of CVE-2018-17846 is high with a severity score of 7.5.
What software is affected by CVE-2018-17846?
The software affected by CVE-2018-17846 is the html package (aka x/net/html) through 2018-09-25 in Go.
What are the references for CVE-2018-17846?
The references for CVE-2018-17846 are: 1. https://nvd.nist.gov/vuln/detail/CVE-2018-17846 2. https://github.com/golang/go/issues/27842 3. https://go-review.googlesource.com/c/137275
How can I fix CVE-2018-17846?
To fix CVE-2018-17846, you should update the html package to version 0.0.0-20190125091013-d26f9f9a57f3 or later.