CVE-2018-17846

Vulnerability

The x/net/html package in Go, specifically the html.Parse function, mishandles a specific sequence of HTML elements (`). This causes an infinite loop because the state machine functions inSelectIM and inSelectInTableIM do not comply with the HTML specification. Affected versions include all releases of golang.org/x/net/html` up to commit 4b62a64f59f7 (September 25, 2018). [1][2]

Exploitation

An attacker can trigger the infinite loop by providing a crafted HTML document to any application that uses the html.Parse function. No authentication or special privileges are required; the attacker only needs the ability to supply input to the parser, such as by submitting a malicious web page to a parsing service or uploading a file containing the crafted HTML.

Impact

Successful exploitation results in a denial of service (DoS) condition, as the parser enters an infinite loop, consuming CPU resources indefinitely. This can cause the application or service to become unresponsive, affecting availability. No information disclosure, file modification, or remote code execution is involved.

Mitigation

The vulnerability is fixed in commit d26f9f9a57f3fab6a695bec0d84433c2c50f8bbf of the golang.org/x/net repository, which was merged on January 25, 2019. Users should update their golang.org/x/net dependency to a version that includes this commit. The Go vulnerability database lists this as GO-2020-0014. [2][3] For Fedora distributions, the fix is included in updated packages; however, the specific versions are not detailed in the available references.