Update module golang.org/x/net to v0.55.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/net	v0.33.0 → v0.55.0

---

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

CVE-2025-22870 / GHSA-qxp5-gwg8-xv66

More information

Details

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-22870
• https://go.dev/cl/654697
• https://go.dev/issue/71984
• https://pkg.go.dev/vuln/GO-2025-3503
• http://www.openwall.com/lists/oss-security/2025/03/07/2
• https://security.netapp.com/advisory/ntap-20250509-0007
• https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ
• https://github.com/advisories/GHSA-qxp5-gwg8-xv66

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

golang.org/x/net vulnerable to Cross-site Scripting

CVE-2025-22872 / GHSA-vvgc-356p-c3xw

More information

Details

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-22872
• https://go.dev/cl/662715
• https://go.dev/issue/73070
• https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
• https://pkg.go.dev/vuln/GO-2025-3595
• https://security.netapp.com/advisory/ntap-20250516-0007
• https://github.com/advisories/GHSA-vvgc-356p-c3xw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Go Net HTML parser is vulnerable to denial of service

CVE-2026-25680 / GHSA-5cv4-jp36-h3mw

More information

Details

In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-25680
• https://go.dev/cl/781702
• https://go.dev/issue/79573
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://pkg.go.dev/vuln/GO-2026-5028
• https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472
• https://go.googlesource.com/net/+/refs/tags/v0.55.0
• https://github.com/advisories/GHSA-5cv4-jp36-h3mw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: examples/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.22.11 -> 1.25.0
golang.org/x/crypto	v0.31.0 -> v0.51.0
golang.org/x/sys	v0.28.0 -> v0.45.0
golang.org/x/text	v0.21.0 -> v0.37.0

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.22.11 -> 1.25.0
golang.org/x/crypto	v0.31.0 -> v0.51.0
golang.org/x/sys	v0.28.0 -> v0.45.0
golang.org/x/text	v0.21.0 -> v0.37.0

[github-actions]

Dependency Review

The following issues were found:

• ❌ 2 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

examples/go.mod

Name	Version	Vulnerability	Severity
golang.org/x/crypto	0.51.0	golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses	critical
		golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed	critical
		golang.org/x/crypto vulnerable to infinite loop on large channel writes	critical
		golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status	critical
		golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement	critical
		golang.org/x/crypto doesn't enforce invoking key constraints	critical
		golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys	critical
		golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic	high
		golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS	high
		golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions	moderate
		golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow	moderate
		golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS	moderate
		golang.org/x/crypto: Invoking pathological inputs can lead to client panic	moderate

go.mod

Name	Version	Vulnerability	Severity
golang.org/x/crypto	0.51.0	golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses	critical
		golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed	critical
		golang.org/x/crypto vulnerable to infinite loop on large channel writes	critical
		golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status	critical
		golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement	critical
		golang.org/x/crypto doesn't enforce invoking key constraints	critical
		golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys	critical
		golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic	high
		golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS	high
		golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions	moderate
		golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow	moderate
		golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS	moderate
		golang.org/x/crypto: Invoking pathological inputs can lead to client panic	moderate

OpenSSF Scorecard

Package	Version	Score	Details
gomod/golang.org/x/crypto	0.51.0	Unknown	Unknown
gomod/golang.org/x/net	0.55.0	Unknown	Unknown
gomod/golang.org/x/sys	0.45.0	Unknown	Unknown
gomod/golang.org/x/text	0.37.0	Unknown	Unknown
gomod/golang.org/x/crypto	0.51.0	Unknown	Unknown
gomod/golang.org/x/net	0.55.0	Unknown	Unknown
gomod/golang.org/x/sys	0.45.0	Unknown	Unknown
gomod/golang.org/x/text	0.37.0	Unknown	Unknown

Scanned Files

• examples/go.mod
• go.mod