Published Date: December 19, 2024
| Package | Affected Versions | Patched Versions | Severity |
|---|---|---|---|
| 📦 golang.org/x/net (Go) | < 0.33.0 | 0.33.0 | High |
Description
Vulnerability Overview
The
golang.org/x/net/html package contains a vulnerability in its parsing logic. When given specially crafted input, the Parse functions process the content in a way that is non-linear relative to the input’s length. This means the parsing time increases disproportionately as the input size grows. An attacker could exploit this to cause extremely slow parsing, effectively leading to a denial of service (DoS).Potential Impact
Applications relying on the
golang.org/x/net/html package are at risk of DoS if they process untrusted input using the vulnerable Parse functions. Attackers can exploit this by submitting intentionally malformed or excessively large input, tying up resources and rendering the application unresponsive.Patches & Workarounds
Recommendation: How to Fix
Upgrade to a Patched Version
- Update the
golang.org/x/netpackage to version 0.33.0 or later:
go get golang.org/x/net@v0.33.0
- Rebuild your application after updating the dependency.
Temporary Workaround
If upgrading immediately is not an option, consider the following mitigations:
- Input Validation: Validate and limit input size before parsing. Reject excessively large or suspicious inputs.
- Rate Limiting: Implement rate limiting for requests or inputs being parsed to prevent abuse.
- Timeouts: Use a timeout mechanism during parsing to abort processing for overly long tasks.
Example Fix
Here’s an example of restricting input size before parsing:
package main
import (
“bytes”
“golang.org/x/net/html”
“io”
)
const MaxInputSize = 10 * 1024 // 10 KB limit
func safeParse(input io.Reader) (*html.Node, error) {
limitedInput := io.LimitReader(input, MaxInputSize)
return html.Parse(limitedInput)
}
This code ensures that any input exceeding 10 KB is ignored, reducing the risk of DoS.
