Teire
Changes
Scan
Docs
Trust
← All changes
golang.org/x/net (Go) · Teire
Changes
Scan
Docs
Trust
Sign in
Worker running
golang.org/x/net
Go
latest
v0.62.0
· 2026-10-27
pkg.go.dev · all 2916 versions
Security advisories
18
golang.org/x/net: Go Net HTML parser is vulnerable to denial of service
fixed in v0.55.0
golang.org/x/net: golang.org/x/net vulnerable to Cross-site Scripting
fixed in v0.38.0
golang.org/x/net: Quadratic parsing complexity in golang.org/x/net/html
fixed in v0.45.0
golang.org/x/net: Infinite parsing loop in golang.org/x/net
fixed in v0.45.0
golang.org/x/net: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Versions that change something
v0.38.0
2025-03
fixes 1 advisory
v0.45.0
2025-10
fixes 2 advisories
v0.53.0
2026-04
fixes 1 advisory
v0.55.0
2026-05
fixes 6 advisories
What each upgrade changes in its API
Changes types
●
breaks on upgrade
→ v0.61.0
· 239
→ v0.61.0
· 3
Removes APIs
●
breaks on upgrade
→ v0.61.0
· 2
→ v0.61.0
· 3
fixed in v0.53.0
golang.org/x/net: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
fixed in v0.55.0
golang.org/x/net: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
fixed in v0.55.0
golang.org/x/net: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
fixed in v0.55.0
golang.org/x/net: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
fixed in v0.55.0
golang.org/x/net: Invoking duplicate attributes can cause XSS in golang.org/x/net/html
fixed in v0.55.0
golang.org/x/net: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
fixed in v0.56.0
golang.org/x/net: HTTP/2 server memory exhaustion due to Trailer headers in net/http
fixed in v0.60.0
golang.org/x/net: HTTP/2 transport accepts malformed framing-related headers in net/http
fixed in v0.60.0
golang.org/x/net: Excessive CPU consumption from repeated initial window changes in net/http
fixed in v0.60.0
golang.org/x/net: Double flow control refund on HTTP/2 server streams in net/http
fixed in v0.60.0
golang.org/x/net: HTTP/2 server crash due to HPACK encoder race in net/http
fixed in v0.60.0
golang.org/x/net: Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
fixed in v0.62.0
golang.org/x/net: Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
fixed in v0.62.0
v0.56.0
2026-06
fixes 1 advisory
v0.60.0
2026-10
fixes 5 advisories
v0.61.0
2026-10
4 changes
4 breaking
v0.62.0
latest
2026-10
fixes 2 advisories