CVE-2018-17846
CVE
High
· CVSS 7.5
False Positivex/net/html: Parser Infinite Loop on Nested Select Inside a MathML Table
This advisory does not affect KrakenD
The bug was fixed in
golang.org/x/net in 2018, and every supported KrakenD release
ships a version released years after the fix (KrakenD Enterprise 3.0.3 ships v0.62.0).
Security scanners that report it are mapping the module version incorrectly. In
addition, KrakenD is an API gateway and does not use x/net/html to parse HTML from
requests or responses.Component
Go extended library (x/net/html)
Disclosed
Nov 4, 2026
CVSS Score
7.5
Description
Versions of Go’s
golang.org/x/net/html package up to September 2018 mishandled
<table><math><select><mi><select></table>. The inSelectIM and inSelectInTableIM
insertion modes did not follow the HTML specification, so html.Parse entered an
infinite loop. An attacker who controls the parsed HTML could exhaust CPU. This does
not affect KrakenD.