golang.org/x/net/html vulnerabilities

The tokenizer incorrectly interprets tags with unquoted attribute values ending with a solidus character (/) as self-closing. When directly using Tokenizer, this can incorrectly mark such tags as self-closing, and when using Parse functions, content following such tags may be placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g., <math>, <svg> contexts).

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity for specially crafted HTML inputs, which can lead to denial of service (DoS).

The html.Parse function in the golang.org/x/net/html package enters an infinite loop when processing specially crafted HTML input. An attacker can exploit this vulnerability to cause a denial of service (DoS).