CVE-2018-17848

Vulnerability

The golang.org/x/net/html package before commit 5e0e0f15960b (released 2018-10-17) mishandles input like ` or during HTML parsing. This triggers an index-out-of-range panic in the (*insertionModeStack).pop method in node.go, called from inHeadIM`. The issue affects all versions up to and including the package as of 2018-09-25 [1][2].

Exploitation

An attacker can exploit this by providing a crafted HTML document to a Go application that parses HTML using html.Parse. No authentication, special privileges, or user interaction is required beyond the parsing of the malicious input. The attack vector is network-based, e.g., via uploading or serving a crafted HTML file. The panic occurs immediately during parsing [2][3].

Impact

Successful exploitation results in a panic (runtime error) that crashes the Go process, leading to a denial of service. There is no evidence of code execution or memory corruption beyond the slice bounds error. The impact is limited to availability [1][4].

Mitigation

The vulnerability is fixed in golang.org/x/net version 0.0.0-20181017171733-5e0e0f15960b (commit 5e0e0f15960b) and later, which is included in Go 1.11. Users should update their x/net/html dependency to a version after that commit. If updating is not possible, avoid parsing untrusted HTML input with the affected package [4].