CVE-2025-22872: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
First published: Wed Apr 16 2025(Updated: )
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
Credit: security@golang.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google x/net | ||
| go/golang.org/x/net | <0.38.0 | 0.38.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-22872?
CVE-2025-22872 has been classified with a moderate severity level due to its potential to lead to incorrect handling of self-closing tags.
How do I fix CVE-2025-22872?
To fix CVE-2025-22872, you should update to the latest version of the Google x/net library, where the issue has been addressed.
What systems are affected by CVE-2025-22872?
CVE-2025-22872 primarily affects systems using the Google x/net library for processing HTML tags.
What are the potential consequences of CVE-2025-22872?
The consequences of CVE-2025-22872 include incorrect parsing of HTML tags, which could lead to potential security vulnerabilities in web applications.
How can I identify if my application is vulnerable to CVE-2025-22872?
You can identify vulnerability to CVE-2025-22872 by reviewing the version of the Google x/net library used in your application and checking for signed vulnerabilities in your codebase.
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vvgc-356p-c3xw
- alias/CVE-2025-22872
- agent/source
- agent/references
- agent/softwarecombine
- agent/severity
- agent/tags
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-cve
- agent/event
- collector/github-advisory
- vendor/google
- canonical/google x/net
- package-manager/go