Vulnerability · Published Apr 16, 2025 · Assigned by Go
CVE-2025-22872Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
Medium 6.5
In plain English
A medium-severity security flaw in golang.org/x/net/html from golang.org/x/net. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-golang-x-net | no fix listed | DEBIAN-CVE-2025-22872 |
| Debian:13 | golang-golang-x-net | 1:0.27.0-2 | DEBIAN-CVE-2025-22872 |
| Debian:14 | golang-golang-x-net | 1:0.27.0-2 | DEBIAN-CVE-2025-22872 |
| Go | golang.org/x/net | 0.38.0 | GHSA-vvgc-356p-c3xw |
| Go | golang.org/x/net | 0.38.0 | GO-2025-3595 |
| Ubuntu:22.04:LTS | golang-golang-x-net | 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1 | USN-8900-1 |
| Ubuntu:22.04:LTS | golang-golang-x-net | 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1 | UBUNTU-CVE-2025-22872 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| golang.org/x/net | golang.org/x/net/html | 0 – before 0.38.0 |