UBUNTU-CVE-2026-97045: Medium severity ubuntu/golang-1.10 vulnerability
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update childTextNodesAreLiteral to continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text, including when the integration point descends from a foster-parented foreign-namespace element such as <mglyph> or <malignmark> under <mtext>.
Event History
Frequently Asked Questions
Which Ubuntu packages are identified as affected?
The listed packages are containerd, google-guest-agent, google-osconfig-agent, adsys, golang-1.13, golang-golang-x-net, golang-1.10, and golang-golang-x-net-dev.
What input structure is required to trigger the incorrect parsing behavior?
The issue involves a tree containing an HTML integration point that is itself beneath an element foster-parented into a foreign namespace, with examples including mglyph or malignmark under mtext. Re-parsing rendered output can then resolve the subtree in a different foreign namespace.