← Scan another repo

github.com/microcosm-cc/bluemonday

@ aba082a57c75

Submitted 8/4/2026, 1:45:55 AM · Status: ok

Risk grade
F
86 / 100
Findings
111
0 critical8 high22 medium0 low81 info0 on CISA KEV0ATT&CK
Showing 111 of 111 findings

Findings

  • Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
    grypeCVE-2026-46600EPSS 0.3%
  • The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com"
    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in progra…
    grypeCVE-2026-39821EPSS 0.7%
  • When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
    grypeCVE-2026-33814EPSS 0.8%
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    trivyCVE-2026-27136
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    trivyCVE-2026-25681
  • golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html
    An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
    trivyCVE-2024-45338
  • golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program…
    trivyCVE-2026-39821
  • net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
    trivyCVE-2026-33814

This report is public.