CVE-2018-17848: Out-of-bounds Read
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.
Other sources
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-17848?
CVE-2018-17848 is considered a high severity vulnerability due to its potential to cause application crashes.
How do I fix CVE-2018-17848?
To fix CVE-2018-17848, upgrade to the version 0.0.0-20190125002852-4b62a64f59f7 or later of the html package in Go.
Which software is affected by CVE-2018-17848?
CVE-2018-17848 affects the html package (x/net/html) in Go version prior to 0.0.0-20190125002852-4b62a64f59f7.
What happens if CVE-2018-17848 is exploited?
Exploitation of CVE-2018-17848 may lead to a panic runtime error, causing a denial of service in applications using the affected html package.
Is CVE-2018-17848 applicable to all versions of Go?
CVE-2018-17848 is applicable to specific Go versions up to and including 2018-09-25, and not all versions of Go are impacted.