p PatchFirst

CVE-2025-22872

CVE-2025-22872 · Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

CVSS 6.5 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • golang.org/x/net/html

    Versions
    • ≥ 0, < 0.38.0: Affected (semver)

    Update to 0.38.0

  • golang-golang-x-net Debian:12

    Versions
    • 1:0.10.0-1
    • 1:0.11.0-1
    • 1:0.14.0-1
    • 1:0.15.0-1
    • 1:0.15.0-2
    • 1:0.17.0+dfsg-1
    • 1:0.19.0+dfsg-1
    • 1:0.20.0+dfsg-1
    • 1:0.21.0+dfsg-1
    • 1:0.22.0+dfsg-1
    • 1:0.23.0+dfsg-1
    • 1:0.24.0+dfsg-1
    • 1:0.25.0+dfsg-1
    • 1:0.26.0+dfsg-1
    • 1:0.26.0+dfsg-2
    • 1:0.27.0-1
    • 1:0.27.0-2
    • 1:0.47.0-1
    • 1:0.47.0-2
    • 1:0.53.0-1
    • 1:0.53.0-2
    • 1:0.53.0-2~bpo13+1
    • 1:0.55.0-1
    • 1:0.56.0-1
    • 1:0.57.0-1
    • 1:0.58.0-1
    • 1:0.7.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-golang-x-net Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:0.27.0-2

    Update to 1:0.27.0-2

  • golang-golang-x-net Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:0.27.0-2

    Update to 1:0.27.0-2

  • golang-golang-x-net-dev Ubuntu:Pro:16.04:LTS

    Versions
    • 0.0+git20150226.3d87fd6-3
    • 0.0+git20151007.b846920+dfsg-1
    • 1:0.0+git20150817.66f0418-1
    • 1:0.0+git20160110.4fd4a9f-1
    • 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2

    Update to 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2

  • juju-core Ubuntu:Pro:16.04:LTS

    Versions
    • 1.24.6-0ubuntu3
    • 1.25.0-0ubuntu1
    • 1.25.0-0ubuntu2
    • 1.25.0-0ubuntu3
    • 2.0~beta4-0ubuntu2
    • 2.0~beta6-0ubuntu1.16.04.1
    • 2.0~beta7-0ubuntu1.16.04.1
    • 2.0~beta12-0ubuntu1.16.04.1
    • 2.0~beta15-0ubuntu2.16.04.1
    • 2.0.0-0ubuntu0.16.04.2
    • 2.0.2-0ubuntu0.16.04.1
    • 2.0.2-0ubuntu0.16.04.2
    • 2.3.1-0ubuntu0.16.04.1
    • 2.3.2-0ubuntu0.16.04.1
    • 2.3.7-0ubuntu0.16.04.1
    • 2.3.7-0ubuntu0.16.04.1+esm1
    Affected ranges
    • ECOSYSTEM: < 2.3.7-0ubuntu0.16.04.1+esm2

    Update to 2.3.7-0ubuntu0.16.04.1+esm2

  • lxd Ubuntu:Pro:16.04:LTS

    Versions
    • 0.20-0ubuntu4
    • 0.21-0ubuntu3
    • 0.21-0ubuntu5
    • 0.22-0ubuntu1
    • 0.22-0ubuntu2
    • 0.23-0ubuntu1
    • 0.23-0ubuntu2
    • 0.23-0ubuntu3
    • 0.24-0ubuntu2
    • 0.24-0ubuntu3
    • 0.24-0ubuntu4
    • 0.25-0ubuntu1
    • 0.26-0ubuntu2
    • 0.26-0ubuntu3
    • 0.27-0ubuntu1
    • 0.27-0ubuntu2
    • 2.0.0~beta1-0ubuntu3
    • 2.0.0~beta1-0ubuntu4
    • 2.0.0~beta2-0ubuntu1
    • 2.0.0~beta2-0ubuntu2
    • 2.0.0~beta3-0ubuntu1
    • 2.0.0~beta3-0ubuntu2
    • 2.0.0~beta3-0ubuntu3
    • 2.0.0~beta3-0ubuntu4
    • 2.0.0~beta4-0ubuntu1
    • 2.0.0~beta4-0ubuntu2
    • 2.0.0~beta4-0ubuntu3
    • 2.0.0~beta4-0ubuntu4
    • 2.0.0~beta4-0ubuntu5
    • 2.0.0~beta4-0ubuntu6
    • 2.0.0~beta4-0ubuntu7
    • 2.0.0~rc1-0ubuntu1
    • 2.0.0~rc1-0ubuntu2
    • 2.0.0~rc1-0ubuntu3
    • 2.0.0~rc2-0ubuntu2
    • 2.0.0~rc2-0ubuntu3
    • 2.0.0~rc3-0ubuntu1
    • 2.0.0~rc3-0ubuntu2
    • 2.0.0~rc3-0ubuntu3
    • 2.0.0~rc3-0ubuntu4
    • 2.0.0~rc4-0ubuntu1
    • 2.0.0~rc5-0ubuntu1
    • 2.0.0~rc6-0ubuntu1
    • 2.0.0~rc6-0ubuntu2
    • 2.0.0~rc7-0ubuntu1
    • 2.0.0~rc7-0ubuntu2
    • 2.0.0~rc8-0ubuntu1
    • 2.0.0~rc8-0ubuntu2
    • 2.0.0~rc8-0ubuntu3
    • 2.0.0~rc8-0ubuntu5
    • 2.0.0~rc8-0ubuntu6
    • 2.0.0~rc8-0ubuntu7
    • 2.0.0~rc9-0ubuntu2
    • 2.0.0~rc9-0ubuntu3
    • 2.0.0~rc9-0ubuntu4
    • 2.0.0~rc9-0ubuntu5
    • 2.0.0-0ubuntu1
    • 2.0.0-0ubuntu2
    • 2.0.0-0ubuntu3
    • 2.0.0-0ubuntu4
    • 2.0.1-0ubuntu1~16.04.1
    • 2.0.2-0ubuntu1~16.04.1
    • 2.0.3-0ubuntu1~ubuntu16.04.2
    • 2.0.4-0ubuntu1~ubuntu16.04.1
    • 2.0.5-0ubuntu1~ubuntu16.04.1
    • 2.0.8-0ubuntu1~ubuntu16.04.1
    • 2.0.8-0ubuntu1~ubuntu16.04.2
    • 2.0.9-0ubuntu1~16.04.1
    • 2.0.9-0ubuntu1~16.04.2
    • 2.0.10-0ubuntu1~16.04.1
    • 2.0.10-0ubuntu1~16.04.2
    • 2.0.11-0ubuntu1~16.04.2
    • 2.0.11-0ubuntu1~16.04.4
    • 2.0.11-0ubuntu1~16.04.4+esm1
    Affected ranges
    • ECOSYSTEM: < 2.0.11-0ubuntu1~16.04.4+esm2

    Update to 2.0.11-0ubuntu1~16.04.4+esm2

  • lxd Ubuntu:Pro:18.04:LTS

    Versions
    • 2.18-0ubuntu6
    • 2.19-0ubuntu1
    • 2.20-0ubuntu3
    • 2.20-0ubuntu4
    • 2.21-0ubuntu1
    • 2.21-0ubuntu2
    • 2.21-0ubuntu3
    • 2.21-0ubuntu4
    • 3.0.0~beta2-0ubuntu3
    • 3.0.0~beta3-0ubuntu3
    • 3.0.0~beta5-0ubuntu2
    • 3.0.0~beta7-0ubuntu1
    • 3.0.0-0ubuntu1
    • 3.0.0-0ubuntu2
    • 3.0.0-0ubuntu3
    • 3.0.0-0ubuntu4
    • 3.0.1-0ubuntu1~18.04.1
    • 3.0.2-0ubuntu1~18.04.1
    • 3.0.3-0ubuntu1~18.04.1
    • 3.0.3-0ubuntu1~18.04.2
    • 3.0.3-0ubuntu1~18.04.2+esm1
    Affected ranges
    • ECOSYSTEM: < 3.0.3-0ubuntu1~18.04.2+esm2

    Update to 3.0.3-0ubuntu1~18.04.2+esm2

  • golang-golang-x-net-dev Ubuntu:Pro:18.04:LTS

    Versions
    • 1:0.0+git20170629.c81e7f2+dfsg-1ubuntu1
    • 1:0.0+git20170629.c81e7f2+dfsg-1ubuntu2
    • 1:0.0+git20170629.c81e7f2+dfsg-2
    • 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2

    Update to 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2

  • golang-golang-x-net-dev Ubuntu:Pro:20.04:LTS

    Versions
    • 1:0.0+git20190811.74dc4d7+dfsg-1
    • 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2

    Update to 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2

  • golang-golang-x-net Ubuntu:22.04:LTS

    Versions
    • 1:0.0+git20210119.5f4716e+dfsg-4
    • 1:0.0+git20210805.aaa1db6+dfsg-1
    • 1:0.0+git20211209.491a49a+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1

    Update to 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1

  • golang-golang-x-net Ubuntu:Pro:22.04:LTS

    Versions
    • 1:0.0+git20210119.5f4716e+dfsg-4
    • 1:0.0+git20210805.aaa1db6+dfsg-1
    • 1:0.0+git20211209.491a49a+dfsg-1
    • 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2

    Update to 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2

  • golang-golang-x-net Ubuntu:Pro:24.04:LTS

    Versions
    • 1:0.10.0-1
    • 1:0.17.0+dfsg-1
    • 1:0.20.0+dfsg-1
    • 1:0.21.0+dfsg-1
    • 1:0.21.0+dfsg-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1:0.21.0+dfsg-1ubuntu0.1~esm2

    Update to 1:0.21.0+dfsg-1ubuntu0.1~esm2

Original sources

Check your server →