CVE-2025-22872: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

Deferred

AliasesSUSE-SU-2025:01940-2SUSE-SU-2025:01945-1SUSE-SU-2025:02121-1+3296 more

Published 16-04-2025Last modified 16-05-2025

Vulnerability summary

CVE-2025-22872 is a medium (CVSS 6.5) vulnerability in golang.org/x/net golang.org/x/net/html. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.55%

0%100%

Low · +0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 48 · Related 510

OPENSUSE-SU-2025:15171-1 OPENSUSE-SU-2025:15207-1 OPENSUSE-SU-2025:15304-1 OPENSUSE-SU-2025:15305-1 OPENSUSE-SU-2025:15454-1 OPENSUSE-SU-2025:15772-1+94 more

Showing 100 of 510.

Timeline

16-04-2025
PublishedVulnerability first disclosed.
16-05-2025
Last modifiedVulnerability information updated.

Description

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

CVSS metrics

7 scores · 7 sources · 2 versions

v4.05.3v3.16.5

EPSS trend

Probability

0.55%

Chance of exploitation in the next 30 days

Percentile

46%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.53% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

aactl< 0.4.12-r31
actions-runner-controller< 0.11.0-r2
actions-runner-controller-compat< 0.11.0-r2
actions-runner-controller-fips< 0.11.0-r2
actions-runner-controller-fips-compat< 0.11.0-r2

addon-resizer< 1.8.23-r5
addon-resizer-compat< 1.8.23-r5
addon-resizer-fips< 1.8.23-r5
addon-resizer-fips-compat< 1.8.23-r5
amass< 4.2.0-r23
amazon-cloudwatch-agent< 1.300055.0-r1
amazon-cloudwatch-agent-all< 1.300055.0-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard< 1.300055.0-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300055.0-r1
amazon-cloudwatch-agent-compat< 1.300055.0-r1
amazon-cloudwatch-agent-config-downloader< 1.300055.0-r1
amazon-cloudwatch-agent-config-downloader-fips< 1.300055.0-r1
amazon-cloudwatch-agent-config-translator< 1.300055.0-r1
amazon-cloudwatch-agent-config-translator-fips< 1.300055.0-r1
amazon-cloudwatch-agent-fips< 1.300055.0-r1
amazon-cloudwatch-agent-operator< 2.2.0-r4
amazon-cloudwatch-agent-operator-compat< 2.2.0-r4
amazon-cloudwatch-agent-operator-fips< 2.2.0-r4
amazon-cloudwatch-agent-operator-fips-compat< 2.2.0-r4
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent< 1.300055.0-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300055.0-r1
amazon-eks-ami< 20250403-r1
amazon-k8s-cni< 1.19.3-r4
amazon-k8s-cni-compat< 1.19.3-r4
amazon-k8s-cni-fips< 1.19.3-r6
amazon-k8s-cni-init< 1.19.3-r4
amazon-k8s-cni-init-compat< 1.19.3-r4
amazon-k8s-cni-init-fips< 1.19.3-r6
amazon-k8s-cni-init-fips-compat< 1.19.3-r6
amazon-ssm-agent< 3.3.2299.0-r1
amazon-ssm-agent-ecs-exec< 3.3.2299.0-r1
ansible-operator< 1.37.2-r3
ansible-operator-compat< 1.37.2-r3
apache-beam-python-3.11-sdk< 2.64.0-r2
argo-cd-2.11< 2.11.13-r8
argo-cd-2.13< 2.13.7-r2
argo-cd-2.13-compat< 2.13.7-r2
argo-cd-2.13-repo-server< 2.13.7-r2
argo-cd-2.14< 2.14.10-r2
argo-cd-2.14-compat< 2.14.10-r2
argo-cd-2.14-repo-server< 2.14.10-r2
argo-cd-3.0< 3.0.0-r2
argo-cd-3.0-compat< 3.0.0-r2
argo-cd-3.0-iamguarded-compat< 3.0.0-r2
argo-cd-3.0-repo-server< 3.0.0-r2
argo-cd-fips-2.14< 2.14.10-r2
argo-cd-fips-2.14-compat< 2.14.10-r2
argo-cd-fips-2.14-repo-server< 2.14.10-r2
argo-cd-fips-3.0< 3.0.0-r1
argo-cd-fips-3.0-compat< 3.0.0-r1
argo-cd-fips-3.0-iamguarded-compat< 3.0.0-r1
argo-cd-fips-3.0-repo-server< 3.0.0-r1
argo-events< 1.9.6-r1
argo-events-fips< 1.9.6-r1
argo-rollouts< 1.8.2-r2
argo-rollouts-fips< 1.8.2-r3
argo-workflows< 3.6.5-r5
argo-workflows-fips< 3.6.5-r5
argocd-image-updater< 0.16.0-r2
argocd-image-updater-compat< 0.16.0-r2
argocd-image-updater-fips< 0.16.0-r3
atlantis< 0.34.0-r1
atlantis-fips< 0.34.0-r1
authservice< 1.0.4-r7
authservice-compat< 1.0.4-r7
authservice-fips< 1.0.4-r7
authservice-fips-compat< 1.0.4-r7
aws-application-networking-k8s< 1.1.0-r7
aws-application-networking-k8s-compat< 1.1.0-r7
aws-application-networking-k8s-fips< 1.1.0-r2
aws-application-networking-k8s-fips-compat< 1.1.0-r2
aws-ebs-csi-driver< 1.42.0-r0
aws-efs-csi-driver< 2.1.7-r2
aws-efs-csi-driver-fips< 2.1.7-r2
aws-iam-authenticator< 0.6.31-r1
aws-load-balancer-controller< 2.12.0-r3
aws-load-balancer-controller-compat< 2.12.0-r3
aws-load-balancer-controller-fips< 2.12.0-r3
aws-network-policy-agent< 1.2.0-r3
aws-network-policy-agent-compat< 1.2.0-r3
aws-network-policy-agent-compat-fips< 1.2.0-r1
aws-network-policy-agent-fips< 1.2.0-r1
aws-privateca-issuer< 1.4.1-r4
aws-privateca-issuer-compat< 1.4.1-r4
aws-privateca-issuer-compat-fips< 1.4.1-r4
aws-privateca-issuer-fips< 1.4.1-r4
aws-s3-controller< 1.0.28-r2
azcopy< 10.28.1-r2
azcopy-fips< 10.28.1-r2
azure-aad-pod-identity-mic< 1.8.17-r23
azure-aad-pod-identity-nmi< 1.8.17-r23
azure-service-operator< 2.12.0-r3
azure-service-operator-compat< 2.12.0-r3
azure-service-operator-fips< 2.12.0-r2
azure-workload-identity-webhook< 1.5.0-r2
azure-workload-identity-webhook-compat< 1.5.0-r2
azuredisk-csi-1.28< 1.28.12-r2
azuredisk-csi-1.28-compat< 1.28.12-r2
azuredisk-csi-1.29< 1.29.14-r2
azuredisk-csi-1.29-compat< 1.29.14-r2
azuredisk-csi-1.30< 1.30.11-r2
azuredisk-csi-1.30-compat< 1.30.11-r2
azuredisk-csi-1.31< 1.31.7-r1
azuredisk-csi-1.31-compat< 1.31.7-r1
azuredisk-csi-fips-1.28< 1.28.12-r2
azuredisk-csi-fips-1.29< 1.29.14-r2
azuredisk-csi-fips-1.30< 1.30.11-r2
azurefile-csi-1.32< 1.32.1-r1
azurefile-csi-1.32-compat< 1.32.1-r1
bank-vaults< 1.20.4-r30
bank-vaults-fips< 1.20.4-r27
bank-vaults-template< 1.20.4-r30
bank-vaults-template-fips< 1.20.4-r27
blob-csi-1.24< 1.24.9-r2
blob-csi-1.24-compat< 1.24.9-r2
blob-csi-1.25< 1.25.5-r2
blob-csi-1.25-compat< 1.25.5-r2
blob-csi-1.26< 1.26.2-r2
blob-csi-1.26-compat< 1.26.2-r2
blob-csi-fips-1.23< 1.23.11-r2
blob-csi-fips-1.23-compat< 1.23.11-r2
bom< 0.6.0-r20
buildah< 1.39.4-r2
caddy< 2.9.1-r9
caddy-fips< 2.10.0-r0
caddy-man< 2.10.0-r0
caddy-src< 2.9.1-r9
cadvisor< 0.52.1-r5
cadvisor-compat< 0.52.1-r5
cadvisor-fips< 0.52.1-r4
cass-operator< 1.23.2-r2
cass-operator-compat< 1.23.2-r2
cass-operator-compat-fips< 1.23.2-r2
cass-operator-config< 1.23.2-r2
cass-operator-fips< 1.23.2-r2
cass-operator-fips-no-pvc-delete< 1.23.2-r2
cass-operator-fips-no-pvc-delete-compat< 1.23.2-r2
cert-exporter< 2.14.0-r11
cert-exporter-fips< 2.14.0-r11
cert-manager-cmctl< 2.1.1-r12
cert-manager-cmctl-fips< 2.1.1-r11
cert-manager-fips-1.17< 1.17.1-r7
cert-manager-istio-csr< 0.14.0-r8
cert-manager-istio-csr-compat< 0.14.0-r8
cert-manager-webhook-pdns< 2.5.2-r6
cert-manager-webhook-pdns-fips< 2.5.2-r6
cfssl< 1.6.5-r19
cfssl-bundle< 1.6.5-r19
cfssl-bundle-fips< 1.6.5-r11
cfssl-certinfo< 1.6.5-r19
cfssl-certinfo-fips< 1.6.5-r11
cfssl-fips< 1.6.5-r11
cfssl-json< 1.6.5-r19
cfssl-json-fips< 1.6.5-r11
cfssl-mkbundle< 1.6.5-r19
cfssl-mkbundle-fips< 1.6.5-r11
cfssl-multirootca< 1.6.5-r19
cfssl-multirootca-fips< 1.6.5-r11
cfssl-newkey< 1.6.5-r19
cfssl-newkey-fips< 1.6.5-r11
cfssl-scan< 1.6.5-r19
cfssl-scan-fips< 1.6.5-r11
chartmuseum< 0.16.2-r19
chartmuseum-fips< 0.16.2-r17
cilium-envoy-1.16< 1.16.9-r1
cilium-envoy-1.17< 1.17.3-r1
cilium-envoy-fips-1.15< 1.15.16-r1
cilium-envoy-fips-1.16< 1.16.9-r2
cilium-envoy-fips-1.17< 1.17.3-r2
cinder-csi-plugin-fips< 1.32.0-r2
clickhouse-operator< 0.24.5-r1
clickhouse-operator-compat< 0.24.5-r1
clickhouse-operator-fips< 0.24.5-r2
clickhouse-operator-fips-compat< 0.24.5-r2
clickhouse-operator-fips-metrics-exporter< 0.24.5-r2
clickhouse-operator-fips-metrics-exporter-compat< 0.24.5-r2
clickhouse-operator-metrics-exporter< 0.24.5-r1
clickhouse-operator-metrics-exporter-compat< 0.24.5-r1
cloud-provider-gcp-cloud-controller-manager< 33.1.1-r1
cloud-provider-gcp-cloud-controller-manager-compat< 33.1.1-r1
cloud-provider-gcp-cloud-controller-manager-fipsAll versions (No fix recorded)
cloud-provider-gcp-cloud-controller-manager-fips-compatAll versions (No fix recorded)
cloudflared< 2025.4.0-r1
cloudnative-pg< 1.25.1-r33
cloudnative-pg-fips< 1.25.1-r35
cloudnative-pg-fips-plugins< 1.25.1-r35
cloudnative-pg-plugins< 1.25.1-r33
cloudprober< 0.14.0-r1
cloudprober-compat< 0.14.0-r1
cloudprober-fips< 0.14.0-r1
cluster-api-aws-controller< 2.8.4-r1
cluster-api-aws-controller-compat< 2.8.4-r1
cluster-api-aws-controller-fips< 2.8.4-r1
cluster-api-aws-controller-fips-compat< 2.8.4-r1
cluster-api-helm-controller< 0.3.2-r2

Show all 200

1 vendor · 200 products · Showing 200 of 2422

References

46 links

go.dev/cl/662715REPORTWEBFIX
go.dev/issue/73070WEBREPORT
groups.google.com/g/golang-announce/c/ezSKR9vqbqAREPORTWEB
pkg.go.dev/vuln/GO-2025-3595REPORTWEB
security.netapp.com/advisory/ntap-20250516-0007/
www.suse.com/support/update/announcement/2025/suse-su-202501940-2/Advisory
bugzilla.suse.com/1241865REPORT
www.suse.com/security/cve/CVE-2025-22872WEB
www.suse.com/support/update/announcement/2025/suse-su-202501945-1/Advisory
bugzilla.suse.com/1241781REPORT

Show all 46 references

www.suse.com/support/update/announcement/2025/suse-su-202502121-1/Advisory
bugzilla.suse.com/1241802REPORT
www.suse.com/support/update/announcement/2025/suse-su-202502336-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202502350-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202502350-2/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202502351-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202502366-1/Advisory
bugzilla.suse.com/1240150REPORT
bugzilla.suse.com/1241830REPORT
bugzilla.suse.com/1242114REPORT
bugzilla.suse.com/1243833REPORT
bugzilla.suse.com/1244035REPORT
www.suse.com/support/update/announcement/2025/suse-su-202502366-2/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202502383-1/Advisory
bugzilla.suse.com/1229008REPORT
bugzilla.suse.com/1245087REPORT
www.suse.com/support/update/announcement/2025/suse-su-202502383-2/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202520457-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202520510-1/Advisory
bugzilla.suse.com/1246556REPORT
www.suse.com/support/update/announcement/2025/suse-su-202520535-1/Advisory
ubuntu.com/security/CVE-2025-22872REPORT
www.cve.org/CVERecord?id=CVE-2025-22872REPORT
github.com/TheDegenerateDev5150/net/commit/e1fcd82abba34df74614020343be8eb1fe85f0d9REPORT
ubuntu.com/security/notices/USN-8089-1Advisory
ubuntu.com/security/notices/USN-8089-2Advisory
ubuntu.com/security/notices/USN-8089-3Advisory
ubuntu.com/security/notices/USN-8900-1Advisory
security-tracker.debian.org/tracker/CVE-2025-22872Advisory
nvd.nist.gov/vuln/detail/CVE-2025-22872AdvisoryOval
security.netapp.com/advisory/ntap-20250516-0007WEB
www.suse.com/support/update/announcement/2025/suse-su-202501940-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202501941-1/Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory