CVE-2018-17142

Vulnerability

The html package in golang.org/x/net (through 2018-09-17) mishandles a specific sequence of HTML tags: `. When this input is parsed by html.Parse, a nil pointer dereference occurs in parseCurrentToken in parse.go, causing a panic [1][3]. The issue affects all versions of x/net/html` up to the commit dated 2018-09-17 [2].

Exploitation

An attacker needs only the ability to supply crafted HTML content to an application that calls html.Parse on user-controllable input. No authentication or special privileges are required. The attack is trivially executed by sending an HTTP request or uploading a file containing the malformed tag sequence [3]. The panic completely terminates the Go program, resulting in a denial of service.

Impact

Successful exploitation causes a runtime panic, crashing the Go process. This leads to a denial of service (DoS) with no information disclosure or privilege escalation. The impact is limited to availability [1][2].

Mitigation

As of the vulnerability publication date (2018-09-17), no patched version of x/net is available [1]. The issue was reported in GitHub issue #27702 [3]. Developers should either avoid parsing untrusted HTML with the affected package or implement a recover() mechanism to handle panics gracefully. Later versions of Go and x/net may include a fix; users are advised to upgrade to the latest release [2].