PatchTheCVECVE-2026-27136: Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-27136 is a medium-severity flaw (CVSS 6.1) affecting net. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 87%) |
| CISA exploited list | No |
| Weakness | CWE-1021 |
| Published | 2026-05-22 |
| Last modified | 2026-07-23 |
Last updated 2026-07-23 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Official advisories
- AlmaLinux Errata: [ALSA-2026:37123] Important: podman security, bug fix, and enhancement update 2026-07-13
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-27136?
net: upgrade to 0.55.0. Exact commands for each OS are on this page.
Is CVE-2026-27136 being exploited?
CVE-2026-27136 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-27136 affect?
CVE-2026-27136 affects net. Severity is medium (CVSS 6.1). Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
How urgent is CVE-2026-27136?
Priority 25/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2026-39821 CRITICAL 9.6 UPGRADE The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only la
- CVE-2026-25680 MEDIUM 6.5 UPGRADE Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
- CVE-2026-25681 MEDIUM 6.1 UPGRADE Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
- CVE-2026-42502 MEDIUM 6.1 UPGRADE Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
- CVE-2026-42506 MEDIUM 6.1 UPGRADE Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree