CVE-2018-17075
CVE
High
· CVSS 7.5
False Positivex/net/html: Parser Panic on Template Elements in Frameset Insertion Mode
This advisory does not affect KrakenD
The bug was fixed in
golang.org/x/net in 2018, and every supported KrakenD release
ships a version released years after the fix (KrakenD Enterprise 3.0.3 ships v0.62.0).
Security scanners that report it are mapping the module version incorrectly. In
addition, KrakenD is an API gateway and does not use x/net/html to parse HTML from
requests or responses.Component
Go extended library (x/net/html)
Disclosed
Nov 4, 2026
CVSS Score
7.5
Description
Versions of Go’s
golang.org/x/net/html package released before July 2018 mishandled
the “in frameset” insertion mode. Calling html.Parse on input such as
<template><object>, <template><applet> or <template><marquee> caused a runtime
panic, so an attacker who controls the parsed HTML could crash the process. This does
not affect KrakenD.