6.5
Moyenne
CVE-2025-22872 The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as…
Description
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| golang.org/x/net/html 0.38 | premières → < 0.38.0 | 0.38.0 |
Références
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Chronologie
- Publiée
- Dernière modification
Autres CVE de golang.org/x/net/html
Les 12 CVE de golang.org/x/net/html →
CVE-2026-78661
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
7.5
Élevée
CVE-2026-97045
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
6.1
Moyenne
CVE-2026-27136
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
6.1
Moyenne
CVE-2026-25680
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
6.5
Moyenne