CVE-2018-17848
CVE
High
· CVSS 7.5
False Positivex/net/html: Parser Panic on Formatting Element Inside a MathML Template
This advisory does not affect KrakenD
The bug was fixed in
golang.org/x/net in 2018, and every supported KrakenD release
ships a version released years after the fix (KrakenD Enterprise 3.0.3 ships v0.62.0).
Security scanners that report it are mapping the module version incorrectly. In
addition, KrakenD is an API gateway and does not use x/net/html to parse HTML from
requests or responses.Component
Go extended library (x/net/html)
Disclosed
Nov 4, 2026
CVSS Score
7.5
Description
Versions of Go’s
golang.org/x/net/html package up to September 2018 mishandled
<math><template><mn><b></template>, which caused an index out of range panic in
(*insertionModeStack).pop during an html.Parse call. An attacker who controls the
parsed HTML could crash the process. This does not affect KrakenD.