CVE-2018-17847

Vulnerability

[1] states that the html package (x/net/html) through version 2018-09-25 mishandles the crafted HTML `. The parser enters an inconsistent state when processing foreign content, causing an index out-of-range panic in (*nodeStack).pop called from (*parser).clearActiveFormattingElements in node.go and parse.go [2][3]. Affected are all versions of golang.org/x/net/html` up to and including the commit from 2018-09-25. No specific configuration is required; any program that parses arbitrary HTML using this package is vulnerable.

Exploitation

An attacker can supply the malformed HTML as input to any application that parses HTML using the vulnerable package. No authentication or special network position is needed—simply feeding the string to html.Parse triggers the panic [2]. The proof-of-concept code provided in the issue reproduces the crash deterministically [3].

Impact

A remote attacker can cause a denial of service (panic) in the application, potentially crashing the process. The vulnerability does not allow code execution or information disclosure; it is strictly a denial-of-service condition. The panic originates from the parser's internal stack management, leading to runtime termination.

Mitigation

The vulnerability is fixed in later versions of golang.org/x/net/html. Users should update to the latest version of the package (after 2018-09-25). According to reference [4], the issue is tracked as GO-2022-0197 and is resolved by updating to a version containing the fix. No workaround is available aside from avoiding untrusted HTML parsing or applying a patch.