Medium severity · published Apr 16, 2025
CVE-2025-22872
Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
golang.org/x/net/html · golang.org/x/net
before 0.38.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-22872
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-22872
go.dev
https://go.dev/cl/662715
go.dev
https://go.dev/issue/73070
groups.google.com
https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
pkg.go.dev
https://pkg.go.dev/vuln/GO-2025-3595
security.netapp.com
https://security.netapp.com/advisory/ntap-20250516-0007/
More from golang.org/x/net/html
6.5
CVE-2026-25680
Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
6.1
CVE-2026-27136
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
6.1
CVE-2026-25681
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
6.1
CVE-2026-42502
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
6.1
CVE-2026-42506
Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
