VDB
GHSA-w4gw-w5jq-g9jh
GHSA-w4gw-w5jq-g9jh
PUBLISHED
CVSS 5.300000190734863 MEDIUM
golang.org/x/net/html has a Quadratic Parsing Complexity issue
Record from GitHub Advisory Database · Published February 12, 2026
golang.org/x/net/html is fixed in 0.45.0 (Go Modules)
golang.org/x/net/html has a Quadratic Parsing Complexity issue
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| golang.org/x/net/html | Go Modules | 0.45.0 |
| runc | Wolfi | 1.4.0-r3 |
| k3s | Wolfi | 1.35.3.1-r9 |
| k3s-1.33 | Wolfi | 1.33.10.1-r0 |
| cilium-envoy-fips-1.17 | Chainguard | 1.17.13-r0 |
| backup-restore-operator-7.0 | Chainguard | 7.0.6-r1 |
| gitness | Chainguard | 3.3.0-r9 |
| nvidia-gpu-operator-validator-24.3 | Chainguard | 24.3.0-r20 |
| rke2-runtime-fips-1.31 | Chainguard | 1.31.14.2.2-r5 |
| k8s-device-plugin | Wolfi | 0.18.2-r4 |
| gendesk | Chainguard | 1.0.10-r6 |
| wuzz | Chainguard | 0.5.0-r18 |
26 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
| Vendor | Product | Versions |
|---|---|---|
| wolfi | spiffe-helper | * |
| chainguard | rke2-runtime-1.34 | * |
| chainguard | spark-operator-fips | * |
| wolfi | stern | * |
| chainguard | otel-cli | * |
| chainguard | net-kourier-fips-1.19 | * |
| wolfi | runc | 0 |
| wolfi | go-licenses | * |
| chainguard | longhorn-cli-fips-1.8 | * |
| chainguard | whereabouts-fips | * |
| chainguard | consul-k8s-fips-1.5 | * |
| chainguard | amazon-ecs-agent-fips | * |
| wolfi | spark-operator | * |
| chainguard | karpenter-1.8 | * |
| chainguard | karpenter-fips-1.8 | * |
| chainguard | cni-plugins-fips | * |
| wolfi | velero-plugin-for-aws | * |
| wolfi | longhorn-instance-manager-1.9 | * |
| chainguard | gpu-operator-24.9 | * |
| wolfi | k3s | 0 |
…and 505 more
Timeline
- Feb 12, 2026 CVE Published
- Apr 30, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-w4gw-w5jq-g9jh
vulnetix vdb fixes GHSA-w4gw-w5jq-g9jhOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-w4gw-w5jq-g9jh/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart