Every CVE Search/ Get API key

CVE-2025-22872

Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

6.5 MediumFix available

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.55%Up 0.5 points since Apr 17, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.5

Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
CVE-2025-22872
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
EUVDEUVD-2025-11453 6.5

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
EUVD-2025-11453
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-vvgc-356p-c3xw 5.3

golang.org/x/net vulnerable to Cross-site Scripting

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
GHSA-vvgc-356p-c3xw
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
NVD 6.5

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
CVE-2025-22872
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2025-22872 6.5

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
DEBIAN-CVE-2025-22872
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVGHSA-vvgc-356p-c3xw 5.3

golang.org/x/net vulnerable to Cross-site Scripting

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
GHSA-vvgc-356p-c3xw
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
Show 48 moreShow less
OSVUBUNTU-CVE-2025-22872 6.5

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
UBUNTU-CVE-2025-22872
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVAZL-60447 No score

CVE-2025-22872 affecting package cni-plugins for versions less than 1.4.0-3

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60447
Updated
2026-11-05
OSVAZL-60450 No score

CVE-2025-22872 affecting package keda for versions less than 2.14.1-7

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60450
Updated
2026-11-02
OSVAZL-60458 No score

CVE-2025-22872 affecting package containerized-data-importer for versions less than 1.57.0-14

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60458
Updated
2026-11-05
OSVAZL-60459 No score

CVE-2025-22872 affecting package cri-tools for versions less than 1.32.0-2

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60459
Updated
2026-11-05
OSVAZL-60467 No score

CVE-2025-22872 affecting package docker-buildx for versions less than 0.14.0-6

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60467
Updated
2026-11-05
OSVAZL-60472 No score

CVE-2025-22872 affecting package cert-manager for versions less than 1.11.2-23

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60472
Updated
2026-11-02
OSVAZL-60474 No score

CVE-2025-22872 affecting package multus for versions less than 4.0.2-5

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60474
Updated
2026-11-05
OSVAZL-60479 No score

CVE-2025-22872 affecting package influxdb for versions less than 2.7.5-5

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60479
Updated
2026-11-02
OSVAZL-60485 No score

CVE-2025-22872 affecting package telegraf for versions less than 1.31.0-10

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60485
Updated
2026-11-02
OSVAZL-60486 No score

CVE-2025-22872 affecting package containerd2 for versions less than 2.0.0-9

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60486
Updated
2026-11-02
OSVAZL-60492 No score

CVE-2025-22872 affecting package ig for versions less than 0.37.0-4

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60492
Updated
2026-11-02
OSVAZL-60502 No score

CVE-2025-22872 affecting package cni-plugins for versions less than 1.3.0-8

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60502
Updated
2026-11-02
OSVAZL-60505 No score

CVE-2025-22872 affecting package kubernetes for versions less than 1.28.4-18

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60505
Updated
2026-11-02
OSVAZL-60510 No score

CVE-2025-22872 affecting package podman 4.1.1-26

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60510
Updated
2026-11-02
OSVAZL-60523 No score

CVE-2025-22872 affecting package sriov-network-device-plugin for versions less than 3.7.0-4

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60523
Updated
2026-11-02
OSVAZL-60528 No score

CVE-2025-22872 affecting package cert-manager for versions less than 1.12.15-4

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60528
Updated
2026-11-05
OSVAZL-60534 No score

CVE-2025-22872 affecting package kubernetes for versions less than 1.30.10-7

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60534
Updated
2026-11-05
OSVAZL-60537 No score

CVE-2025-22872 affecting package kubevirt for versions less than 1.2.0-17

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60537
Updated
2026-11-02
OSVAZL-60542 No score

CVE-2025-22872 affecting package gh for versions less than 2.62.0-8

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60542
Updated
2026-11-02
OSVAZL-60545 No score

CVE-2025-22872 affecting package cf-cli for versions less than 8.7.11-3

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60545
Updated
2026-11-05
OSVAZL-60550 No score

CVE-2025-22872 affecting package prometheus-adapter for versions less than 0.12.0-3

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60550
Updated
2026-11-05
OSVAZL-60554 No score

CVE-2025-22872 affecting package packer for versions less than 1.9.5-9

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60554
Updated
2026-11-02
OSVAZL-60557 No score

CVE-2025-22872 affecting package docker-compose for versions less than 2.27.0-5

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60557
Updated
2026-11-02
OSVAZL-60565 No score

CVE-2025-22872 affecting package helm for versions less than 3.14.2-6

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60565
Updated
2026-11-02
OSVAZL-60568 No score

CVE-2025-22872 affecting package multus for versions less than 4.0.2-8

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60568
Updated
2026-11-02
OSVAZL-60572 No score

CVE-2025-22872 affecting package helm for versions less than 3.15.2-3

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60572
Updated
2026-11-02
OSVAZL-60573 No score

CVE-2025-22872 affecting package kube-vip-cloud-provider for versions less than 0.0.10-4

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60573
Updated
2026-11-02
OSVAZL-60580 No score

CVE-2025-22872 affecting package kubevirt for versions less than 0.59.0-28

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60580
Updated
2026-11-02
OSVAZL-60586 No score

CVE-2025-22872 affecting package cri-tools for versions less than 1.29.0-8

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60586
Updated
2026-11-02
OSVAZL-60588 No score

CVE-2025-22872 affecting package telegraf for versions less than 1.29.4-16

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60588
Updated
2026-11-02
OSVAZL-60595 No score

CVE-2025-22872 affecting package vitess for versions less than 17.0.7-8

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60595
Updated
2026-11-02
OSVAZL-60601 No score

CVE-2025-22872 affecting package sriov-network-device-plugin for versions less than 3.6.2-9

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60601
Updated
2026-11-02
OSVAZL-60604 No score

CVE-2025-22872 affecting package packer for versions less than 1.9.5-13

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-60604
Updated
2026-11-02
OSVAZL-61750 No score

CVE-2025-22872 affecting package yq 4.45.1-1

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-61750
Updated
2026-11-05
OSVAZL-61762 No score

CVE-2025-22872 affecting package podman for versions less than 5.6.1-2

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-61762
Updated
2026-11-02
OSVAZL-61812 No score

CVE-2025-22872 affecting package cri-o 1.30.1-1

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-61812
Updated
2026-11-05
OSVAZL-64185 No score

CVE-2025-22872 affecting package dasel for versions less than 2.8.1-2

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-64185
Updated
2026-11-05
OSVAZL-65664 No score

CVE-2025-22872 affecting package nvidia-container-toolkit for versions less than 1.17.8-3

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-65664
Updated
2026-11-02
OSVAZL-65667 No score

CVE-2025-22872 affecting package nvidia-container-toolkit for versions less than 1.17.8-2

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
AZL-65667
Updated
2026-11-05
OSV No score

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
CVE-2025-22872
Updated
2026-11-02
OSVGO-2025-3595 No score

Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Record
GO-2025-3595
Updated
2026-11-02
OSVopenSUSE-SU-2025:15008-1 No score

govulncheck-vulndb-0.0.20250416T165455-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250416T165455-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15008-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15028-1 No score

distrobuilder-3.2-2.1 on GA media

These are all security issues fixed in the distrobuilder-3.2-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15028-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15034-1 No score

subfinder-2.7.0-3.1 on GA media

These are all security issues fixed in the subfinder-2.7.0-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15034-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15036-1 No score

glow-2.1.0-2.1 on GA media

These are all security issues fixed in the glow-2.1.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15036-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15046-1 No score

docker-28.1.1_ce-16.1 on GA media

These are all security issues fixed in the docker-28.1.1_ce-16.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15046-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15047-1 No score

hauler-1.2.4-1.1 on GA media

These are all security issues fixed in the hauler-1.2.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15047-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
golang.org/x/net
Go
 before 0.38.0
0.38.0
cni-plugins
Azure Linux:3
 before 1.4.0-3
1.4.0-3
keda
Azure Linux:3
 before 2.14.1-7
2.14.1-7
containerized-data-importer
Azure Linux:3
 before 1.57.0-14
1.57.0-14
cri-tools
Azure Linux:3
 before 1.32.0-2
1.32.0-2
docker-buildx
Azure Linux:3
 before 0.14.0-6
0.14.0-6
cert-manager
Azure Linux:2
 before 1.11.2-23
1.11.2-23
multus
Azure Linux:3
 before 4.0.2-5
4.0.2-5
influxdb
Azure Linux:3
 before 2.7.5-5
2.7.5-5
telegraf
Azure Linux:3
 before 1.31.0-10
1.31.0-10
Show 228 moreShow less
Affected packages
PackageAffectedFixed
containerd2
Azure Linux:3
 before 2.0.0-9
2.0.0-9
ig
Azure Linux:3
 before 0.37.0-4
0.37.0-4
cni-plugins
Azure Linux:2
 before 1.3.0-8
1.3.0-8
kubernetes
Azure Linux:2
 before 1.28.4-18
1.28.4-18
podman
Azure Linux:2
 through 4.1.1-26 None known
sriov-network-device-plugin
Azure Linux:3
 before 3.7.0-4
3.7.0-4
cert-manager
Azure Linux:3
 before 1.12.15-4
1.12.15-4
kubernetes
Azure Linux:3
 before 1.30.10-7
1.30.10-7
kubevirt
Azure Linux:3
 before 1.2.0-17
1.2.0-17
gh
Azure Linux:3
 before 2.62.0-8
2.62.0-8
cf-cli
Azure Linux:3
 before 8.7.11-3
8.7.11-3
prometheus-adapter
Azure Linux:3
 before 0.12.0-3
0.12.0-3
packer
Azure Linux:3
 before 1.9.5-9
1.9.5-9
docker-compose
Azure Linux:3
 before 2.27.0-5
2.27.0-5
helm
Azure Linux:2
 before 3.14.2-6
3.14.2-6
multus
Azure Linux:2
 before 4.0.2-8
4.0.2-8
helm
Azure Linux:3
 before 3.15.2-3
3.15.2-3
kube-vip-cloud-provider
Azure Linux:3
 before 0.0.10-4
0.0.10-4
kubevirt
Azure Linux:2
 before 0.59.0-28
0.59.0-28
cri-tools
Azure Linux:2
 before 1.29.0-8
1.29.0-8
telegraf
Azure Linux:2
 before 1.29.4-16
1.29.4-16
vitess
Azure Linux:2
 before 17.0.7-8
17.0.7-8
sriov-network-device-plugin
Azure Linux:2
 before 3.6.2-9
3.6.2-9
packer
Azure Linux:2
 before 1.9.5-13
1.9.5-13
yq
Azure Linux:3
 through 4.45.1-1 None known
podman
Azure Linux:3
 before 5.6.1-2
5.6.1-2
cri-o
Azure Linux:3
 through 1.30.1-1 None known
dasel
Azure Linux:3
 before 2.8.1-2
2.8.1-2
nvidia-container-toolkit
Azure Linux:2
 before 1.17.8-3
1.17.8-3
nvidia-container-toolkit
Azure Linux:3
 before 1.17.8-2
1.17.8-2
golang-golang-x-net
Debian:12
 All versions, plus listed versions
1:0.10.0-11:0.11.0-11:0.14.0-11:0.15.0-11:0.15.0-2
Show 22 moreShow less
1:0.17.0+dfsg-11:0.19.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.22.0+dfsg-11:0.23.0+dfsg-11:0.24.0+dfsg-11:0.25.0+dfsg-11:0.26.0+dfsg-11:0.26.0+dfsg-21:0.27.0-11:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.7.0+dfsg-1
 None known
golang-golang-x-net
Debian:13
 before 1:0.27.0-2
1:0.27.0-2
golang-golang-x-net
Debian:14
 before 1:0.27.0-2
1:0.27.0-2
golang.org/x/net
Root:Go
 before v0.34.0-aikido.3
v0.34.0-aikido.3v0.33.0-aikido.7v0.35.0-aikido.3v0.26.0-aikido.1v0.35.0-aikido.2v0.26.0-aikido.2v0.33.0-aikido.4v0.33.0-aikido.5v0.33.0-aikido.6v0.34.0-aikido.1v0.34.0-aikido.2v0.37.0-aikido.1v0.29.0-aikido.1v0.23.0-aikido.1v0.29.0-aikido.2v0.29.0-aikido.3v0.35.0-aikido.4v0.35.0-aikido.5v0.29.0-aikido.4v0.29.0-aikido.5v0.23.0-aikido.2v0.23.0-aikido.3v0.29.0-aikido.6
rootio-golang.org/x/net
Root:Go
 before v0.33.0-root.io.1
v0.33.0-root.io.1v0.34.0-root.io.3v0.33.0-root.io.7v0.35.0-root.io.3v0.26.0-root.io.1v0.35.0-root.io.2v0.26.0-root.io.2v0.33.0-root.io.4v0.33.0-root.io.5v0.33.0-root.io.6v0.34.0-root.io.1v0.34.0-root.io.2v0.37.0-root.io.1v0.29.0-root.io.1v0.23.0-root.io.1v0.29.0-root.io.2v0.29.0-root.io.3v0.35.0-root.io.4v0.35.0-root.io.5v0.29.0-root.io.4v0.29.0-root.io.5v0.23.0-root.io.2v0.23.0-root.io.3v0.29.0-root.io.6
golang-golang-x-net
Root:Debian:12
 before 1:0.7.0+dfsg-1.root.io.1
1:0.7.0+dfsg-1.root.io.11:0.7.0+dfsg-1.aikido.2
rootio-golang-golang-x-net
Root:Debian:12
 before 1:0.7.0+dfsg-1.root.io.1
1:0.7.0+dfsg-1.root.io.11:0.7.0+dfsg-1.aikido.2
kubernetes1.23
openSUSE:Leap 15.6
 before 1.23.17-150500.3.21.1
1.23.17-150500.3.21.1
kubernetes1.23
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.23.17-150500.3.21.1
1.23.17-150500.3.21.1
kubernetes1.23
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.23.17-150500.3.21.1
1.23.17-150500.3.21.1
kubernetes1.23
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.23.17-150500.3.21.1
1.23.17-150500.3.21.1
kubernetes1.23
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.23.17-150500.3.21.1
1.23.17-150500.3.21.1
kubernetes1.24
openSUSE:Leap 15.6
 before 1.24.17-150500.3.28.1
1.24.17-150500.3.28.1
kubernetes-old
SUSE:Linux Enterprise Module for Containers 15 SP6
 before 1.31.9-150600.13.10.1
1.31.9-150600.13.10.1
kubernetes-old
SUSE:Linux Enterprise Module for Containers 15 SP7
 before 1.31.9-150600.13.10.1
1.31.9-150600.13.10.1
kubernetes-old
openSUSE:Leap 15.6
 before 1.31.9-150600.13.10.1
1.31.9-150600.13.10.1
release-notes-susemanager
SUSE:Manager Server 4.3
From an advisory covering 15 CVEs
 before 4.3.15.2-150400.3.133.1
4.3.15.2-150400.3.133.1
golang-github-prometheus-alertmanager
SUSE:Manager Client Tools 12
From an advisory covering 8 CVEs
 before 0.26.0-1.31.2
0.26.0-1.31.2
golang-github-prometheus-node_exporter
SUSE:Manager Client Tools 12
From an advisory covering 8 CVEs
 before 1.9.1-1.36.2
1.9.1-1.36.2
golang-github-prometheus-prometheus
SUSE:Manager Client Tools 12
From an advisory covering 8 CVEs
 before 2.53.4-1.60.2
2.53.4-1.60.2
grafana
SUSE:Manager Client Tools 12
From an advisory covering 8 CVEs
 before 11.5.5-1.79.2
11.5.5-1.79.2
prometheus-blackbox_exporter
SUSE:Manager Client Tools 12
From an advisory covering 8 CVEs
 before 0.26.0-1.27.1
0.26.0-1.27.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 8 CVEs
 before 1.9.1-1.36.2
1.9.1-1.36.2
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 8 CVEs
 before 1.9.1-1.36.2
1.9.1-1.36.2
golang-github-prometheus-prometheus
SUSE:Manager Client Tools 15
From an advisory covering 8 CVEs
 before 2.53.4-150000.3.62.2
2.53.4-150000.3.62.2
grafana
SUSE:Manager Client Tools 15
From an advisory covering 8 CVEs
 before 11.5.5-150000.1.79.1
11.5.5-150000.1.79.1
prometheus-blackbox_exporter
SUSE:Manager Client Tools 15
From an advisory covering 8 CVEs
 before 0.26.0-150000.1.27.1
0.26.0-150000.1.27.1
prometheus-blackbox_exporter
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 8 CVEs
 before 0.26.0-150000.1.27.1
0.26.0-150000.1.27.1
prometheus-blackbox_exporter
SUSE:Manager Proxy Module 4.3
From an advisory covering 8 CVEs
 before 0.26.0-150000.1.27.1
0.26.0-150000.1.27.1
prometheus-blackbox_exporter
openSUSE:Leap 15.6
From an advisory covering 8 CVEs
 before 0.26.0-150000.1.27.1
0.26.0-150000.1.27.1
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 8 CVEs
 before 11.5.5-150200.3.72.2
11.5.5-150200.3.72.2
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 8 CVEs
 before 11.5.5-150200.3.72.2
11.5.5-150200.3.72.2
grafana
openSUSE:Leap 15.6
From an advisory covering 8 CVEs
 before 11.5.5-150200.3.72.2
11.5.5-150200.3.72.2
helm
SUSE:Linux Enterprise Micro 5.5
 before 3.18.3-150000.1.50.1
3.18.3-150000.1.50.1
helm
SUSE:Linux Enterprise Module for Containers 15 SP6
 before 3.18.3-150000.1.50.1
3.18.3-150000.1.50.1
helm
SUSE:Linux Enterprise Module for Containers 15 SP7
 before 3.18.3-150000.1.50.1
3.18.3-150000.1.50.1
helm
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 3.18.3-150000.1.50.1
3.18.3-150000.1.50.1
helm
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 3.18.3-150000.1.50.1
3.18.3-150000.1.50.1
helm
openSUSE:Leap 15.6
 before 3.18.3-150000.1.50.1
3.18.3-150000.1.50.1
docker
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker
SUSE:Linux Enterprise Module for Containers 15 SP6
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise Module for Containers 15 SP6
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise Micro 5.1
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
docker
SUSE:Enterprise Storage 7.1
From an advisory covering 2 CVEs
 before 28.2.2_ce-150000.227.1
28.2.2_ce-150000.227.1
docker-stable
SUSE:Enterprise Storage 7.1
From an advisory covering 2 CVEs
 before 24.0.9_ce-150000.1.22.1
24.0.9_ce-150000.1.22.1
kubernetes1.27
SUSE:Linux Enterprise Module for Containers 15 SP6
 before 1.27.16-150400.9.16.1
1.27.16-150400.9.16.1
kubernetes1.27
openSUSE:Leap 15.6
 before 1.27.16-150400.9.16.1
1.27.16-150400.9.16.1
kubernetes1.28
SUSE:Linux Enterprise Module for Containers 15 SP6
 before 1.28.13-150400.9.14.1
1.28.13-150400.9.14.1
kubernetes1.28
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.28.13-150400.9.14.1
1.28.13-150400.9.14.1
kubernetes1.28
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.28.13-150400.9.14.1
1.28.13-150400.9.14.1
kubernetes1.28
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.28.13-150400.9.14.1
1.28.13-150400.9.14.1
kubernetes1.28
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.28.13-150400.9.14.1
1.28.13-150400.9.14.1
kubernetes1.28
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.28.13-150400.9.14.1
1.28.13-150400.9.14.1
kubernetes1.28
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.28.13-150400.9.14.1
1.28.13-150400.9.14.1
kubernetes1.28
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.28.13-150400.9.14.1
1.28.13-150400.9.14.1
kubernetes1.28
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.28.13-150400.9.14.1
1.28.13-150400.9.14.1
kubernetes1.25
SUSE:Linux Enterprise Module for Containers 15 SP6
 before 1.25.16-150400.9.22.1
1.25.16-150400.9.22.1
kubernetes1.25
openSUSE:Leap 15.6
 before 1.25.16-150400.9.22.1
1.25.16-150400.9.22.1
docker
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 28.2.2_ce-98.134.1
28.2.2_ce-98.134.1
docker
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 28.2.2_ce-98.134.1
28.2.2_ce-98.134.1
kubernetes1.26
SUSE:Linux Enterprise Module for Containers 15 SP6
 before 1.26.15-150400.9.22.1
1.26.15-150400.9.22.1
kubernetes1.26
openSUSE:Leap 15.6
 before 1.26.15-150400.9.22.1
1.26.15-150400.9.22.1
kubernetes1.26
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.26.15-150400.9.22.1
1.26.15-150400.9.22.1
kubernetes1.26
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.26.15-150400.9.22.1
1.26.15-150400.9.22.1
kubernetes1.26
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.26.15-150400.9.22.1
1.26.15-150400.9.22.1
kubernetes1.26
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.26.15-150400.9.22.1
1.26.15-150400.9.22.1
kubernetes1.26
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.26.15-150400.9.22.1
1.26.15-150400.9.22.1
kubernetes1.26
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.26.15-150400.9.22.1
1.26.15-150400.9.22.1
kubernetes1.26
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.26.15-150400.9.22.1
1.26.15-150400.9.22.1
kubernetes1.26
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.26.15-150400.9.22.1
1.26.15-150400.9.22.1
kubernetes1.23
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Enterprise Storage 7.1
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubevirt
SUSE:Linux Enterprise Module for Containers 15 SP6
From an advisory covering 3 CVEs
 before 1.4.1-150600.5.24.1
1.4.1-150600.5.24.1
kubevirt
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 1.4.1-150600.5.24.1
1.4.1-150600.5.24.1
helm
SUSE:Linux Micro 6.1
 before 3.18.3-slfo.1.1_1.1
3.18.3-slfo.1.1_1.1
docker
SUSE:Linux Micro 6.0
 before 28.3.2_ce-5.1
28.3.2_ce-5.1
helm
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 3.18.4-1.1
3.18.4-1.1
docker
SUSE:Linux Micro 6.1
 before 28.3.2_ce-slfo.1.1_5.1
28.3.2_ce-slfo.1.1_5.1
kubevirt
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 6 CVEs
 before 1.6.3-150700.3.13.1
1.6.3-150700.3.13.1
apptainer
SUSE:Linux Enterprise Module for HPC 15 SP7
From an advisory covering 10 CVEs
 before 1.4.5-150600.4.12.1
1.4.5-150600.4.12.1
squashfuse
SUSE:Linux Enterprise Module for HPC 15 SP7
From an advisory covering 10 CVEs
 before 0.5.0-150600.3.2.1
0.5.0-150600.3.2.1
apptainer
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 10 CVEs
 before 1.4.5-150600.4.12.1
1.4.5-150600.4.12.1
squashfuse
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 10 CVEs
 before 0.5.0-150600.3.2.1
0.5.0-150600.3.2.1
apptainer
openSUSE:Leap 15.6
From an advisory covering 10 CVEs
 before 1.4.5-150600.4.12.1
1.4.5-150600.4.12.1
squashfuse
openSUSE:Leap 15.6
From an advisory covering 10 CVEs
 before 0.5.0-150600.3.2.1
0.5.0-150600.3.2.1
elemental-register
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 1.8.1-160000.1.1
1.8.1-160000.1.1
elemental-toolkit
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 2.3.2-160000.1.1
2.3.2-160000.1.1
elemental-operator
SUSE:Linux Micro 6.0
From an advisory covering 6 CVEs
 before 1.6.10-1.1
1.6.10-1.1
elemental-toolkit
SUSE:Linux Micro 6.0
From an advisory covering 6 CVEs
 before 2.1.5-1.1
2.1.5-1.1
elemental-operator
SUSE:Linux Micro 6.1
From an advisory covering 6 CVEs
 before 1.7.4-slfo.1.1_1.1
1.7.4-slfo.1.1_1.1
elemental-toolkit
SUSE:Linux Micro 6.1
From an advisory covering 6 CVEs
 before 2.2.7-slfo.1.1_1.1
2.2.7-slfo.1.1_1.1
containerized-data-importer
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 12 CVEs
 before 1.64.0-150700.9.11.1
1.64.0-150700.9.11.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
golang-golang-x-net-dev
Ubuntu:Pro:16.04:LTS
 before 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2, plus listed versions
0.0+git20150226.3d87fd6-30.0+git20151007.b846920+dfsg-11:0.0+git20150817.66f0418-11:0.0+git20160110.4fd4a9f-11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1
1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
juju-core
Ubuntu:Pro:16.04:LTS
 before 2.3.7-0ubuntu0.16.04.1+esm2, plus listed versions
1.24.6-0ubuntu31.25.0-0ubuntu11.25.0-0ubuntu21.25.0-0ubuntu32.0~beta4-0ubuntu2
Show 11 moreShow less
2.0~beta6-0ubuntu1.16.04.12.0~beta7-0ubuntu1.16.04.12.0~beta12-0ubuntu1.16.04.12.0~beta15-0ubuntu2.16.04.12.0.0-0ubuntu0.16.04.22.0.2-0ubuntu0.16.04.12.0.2-0ubuntu0.16.04.22.3.1-0ubuntu0.16.04.12.3.2-0ubuntu0.16.04.12.3.7-0ubuntu0.16.04.12.3.7-0ubuntu0.16.04.1+esm1
2.3.7-0ubuntu0.16.04.1+esm2
lxd
Ubuntu:Pro:16.04:LTS
 before 2.0.11-0ubuntu1~16.04.4+esm2, plus listed versions
0.20-0ubuntu40.21-0ubuntu30.21-0ubuntu50.22-0ubuntu10.22-0ubuntu2
Show 45 moreShow less
0.23-0ubuntu10.23-0ubuntu20.23-0ubuntu30.24-0ubuntu20.24-0ubuntu30.24-0ubuntu40.25-0ubuntu10.26-0ubuntu20.26-0ubuntu30.27-0ubuntu10.27-0ubuntu22.0.0~beta1-0ubuntu32.0.0~beta1-0ubuntu42.0.0~beta2-0ubuntu12.0.0~beta2-0ubuntu22.0.0~beta3-0ubuntu12.0.0~beta3-0ubuntu22.0.0~beta3-0ubuntu32.0.0~beta3-0ubuntu42.0.0~beta4-0ubuntu12.0.0~beta4-0ubuntu22.0.0~beta4-0ubuntu32.0.0~beta4-0ubuntu42.0.0~beta4-0ubuntu52.0.0~beta4-0ubuntu62.0.0~beta4-0ubuntu72.0.0~rc1-0ubuntu12.0.0~rc1-0ubuntu22.0.0~rc1-0ubuntu32.0.0~rc2-0ubuntu22.0.0~rc2-0ubuntu32.0.0~rc3-0ubuntu12.0.0~rc3-0ubuntu22.0.0~rc3-0ubuntu32.0.0~rc3-0ubuntu42.0.0~rc4-0ubuntu12.0.0~rc5-0ubuntu12.0.0~rc6-0ubuntu12.0.0~rc6-0ubuntu22.0.0~rc7-0ubuntu12.0.0~rc7-0ubuntu22.0.0~rc8-0ubuntu12.0.0~rc8-0ubuntu22.0.0~rc8-0ubuntu32.0.0~rc8-0ubuntu5
2.0.11-0ubuntu1~16.04.4+esm2
lxd
Ubuntu:Pro:18.04:LTS
 before 3.0.3-0ubuntu1~18.04.2+esm2, plus listed versions
2.18-0ubuntu62.19-0ubuntu12.20-0ubuntu32.20-0ubuntu42.21-0ubuntu1
Show 16 moreShow less
2.21-0ubuntu22.21-0ubuntu32.21-0ubuntu43.0.0~beta2-0ubuntu33.0.0~beta3-0ubuntu33.0.0~beta5-0ubuntu23.0.0~beta7-0ubuntu13.0.0-0ubuntu13.0.0-0ubuntu23.0.0-0ubuntu33.0.0-0ubuntu43.0.1-0ubuntu1~18.04.13.0.2-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.23.0.3-0ubuntu1~18.04.2+esm1
3.0.3-0ubuntu1~18.04.2+esm2
golang-golang-x-net-dev
Ubuntu:Pro:18.04:LTS
 before 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2, plus listed versions
1:0.0+git20170629.c81e7f2+dfsg-1ubuntu11:0.0+git20170629.c81e7f2+dfsg-1ubuntu21:0.0+git20170629.c81e7f2+dfsg-21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm1
1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2
golang-golang-x-net-dev
Ubuntu:Pro:20.04:LTS
 before 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2, plus listed versions
1:0.0+git20190811.74dc4d7+dfsg-11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1
1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2
golang-golang-x-net
Ubuntu:22.04:LTS
 before 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1, plus listed versions
1:0.0+git20210119.5f4716e+dfsg-41:0.0+git20210805.aaa1db6+dfsg-11:0.0+git20211209.491a49a+dfsg-1
1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1
golang-golang-x-net
Ubuntu:Pro:22.04:LTS
 before 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2, plus listed versions
1:0.0+git20210119.5f4716e+dfsg-41:0.0+git20210805.aaa1db6+dfsg-11:0.0+git20211209.491a49a+dfsg-11:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm1
1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2
golang-golang-x-net
Ubuntu:Pro:24.04:LTS
 before 1:0.21.0+dfsg-1ubuntu0.1~esm2, plus listed versions
1:0.10.0-11:0.17.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.21.0+dfsg-1ubuntu0.1~esm1
1:0.21.0+dfsg-1ubuntu0.1~esm2
golang-golang-x-net
Ubuntu:Pro:22.04:LTS
From an advisory covering 6 CVEs
 before 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2, plus listed versions
1:0.0+git20210119.5f4716e+dfsg-41:0.0+git20210805.aaa1db6+dfsg-11:0.0+git20211209.491a49a+dfsg-11:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm1
1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2
golang-golang-x-net
Ubuntu:Pro:24.04:LTS
From an advisory covering 6 CVEs
 before 1:0.21.0+dfsg-1ubuntu0.1~esm2, plus listed versions
1:0.10.0-11:0.17.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.21.0+dfsg-1ubuntu0.1~esm1
1:0.21.0+dfsg-1ubuntu0.1~esm2
golang-golang-x-net
Ubuntu:22.04:LTS
From an advisory covering 8 CVEs
 before 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1, plus listed versions
1:0.0+git20210119.5f4716e+dfsg-41:0.0+git20210805.aaa1db6+dfsg-11:0.0+git20211209.491a49a+dfsg-1
1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1
govulncheck-vulndb
openSUSE:Tumbleweed
 before 0.0.20250416T165455-1.1
0.0.20250416T165455-1.1
distrobuilder
openSUSE:Tumbleweed
 before 3.2-2.1
3.2-2.1
subfinder
openSUSE:Tumbleweed
 before 2.7.0-3.1
2.7.0-3.1
glow
openSUSE:Tumbleweed
 before 2.1.0-2.1
2.1.0-2.1
docker
openSUSE:Tumbleweed
 before 28.1.1_ce-16.1
28.1.1_ce-16.1
hauler
openSUSE:Tumbleweed
 before 1.2.4-1.1
1.2.4-1.1
kubo
openSUSE:Tumbleweed
 before 0.35.0-1.1
0.35.0-1.1
grafana
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 11.6.1+security01-1.1
11.6.1+security01-1.1
alloy
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.9.1-1.1
1.9.1-1.1
helm
openSUSE:Tumbleweed
 before 3.18.3-1.1
3.18.3-1.1
kubernetes1.30
openSUSE:Tumbleweed
 before 1.30.14-1.1
1.30.14-1.1
kubernetes1.31
openSUSE:Tumbleweed
 before 1.31.10-1.1
1.31.10-1.1
kubernetes1.32
openSUSE:Tumbleweed
 before 1.32.6-1.1
1.32.6-1.1
traefik
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 3.4.3-1.1
3.4.3-1.1
traefik2
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 2.11.26-1.1
2.11.26-1.1
trivy
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 0.65.0-1.1
0.65.0-1.1
go-sendxmpp
openSUSE:Tumbleweed
 before 0.15.0-1.1
0.15.0-1.1
kubevirt
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.6.3-1.1
1.6.3-1.1
helm3
openSUSE:Tumbleweed
From an advisory covering 20 CVEs
 before 3.19.2-1.1
3.19.2-1.1
hauler
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 1.3.1-bp160.1.1
1.3.1-bp160.1.1
apptainer
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 1.4.5-1.1
1.4.5-1.1
yq
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 4.53.2-1.1
4.53.2-1.1
kubevirt-1.8
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 1.8.3-1.1
1.8.3-1.1
kubevirt1.8
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 1.8.3-1.1
1.8.3-1.1
velociraptor
openSUSE:Tumbleweed
From an advisory covering 49 CVEs
 before 0.7.0.4.git185.a5708584-2.1
0.7.0.4.git185.a5708584-2.1
lux
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 0.24.1-1.1
0.24.1-1.1
containerized-data-importer1.65
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 1.65.0-2.1
1.65.0-2.1
kured
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 1.23.0-1.1
1.23.0-1.1
kubectl-retina
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 1.3.1-1.1
1.3.1-1.1
kumactl
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 3.0.0-1.1
3.0.0-1.1
timoni
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 0.36.0-1.1
0.36.0-1.1
go-sendxmpp
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 0.15.1-bp160.1.1
0.15.1-bp160.1.1
elemental-register
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 1.8.1-160000.1.1
1.8.1-160000.1.1
elemental-toolkit
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 2.3.2-160000.1.1
2.3.2-160000.1.1
lux
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 0.24.1-bp160.1.1
0.24.1-bp160.1.1
gitea-tea
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 0.15.1-bp160.1.1
0.15.1-bp160.1.1
glab
openSUSE:Leap 16.0
From an advisory covering 24 CVEs
 before 1.114.0-bp160.1.1
1.114.0-bp160.1.1
containerized-data-importer1.65
openSUSE:Leap 16.0
From an advisory covering 39 CVEs
 before 1.65.0-160000.3.1
1.65.0-160000.3.1

History

History
RecordedChangedSources
affected
factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-22872 is a medium vulnerability (CVSS 6.5) in Golang.org/x/net Golang.org/x/net/html, published April 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 45th percentile. Fixed in golang.org/x/net 0.38.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 24 versions and 236 references. The JSON record has them. Also not on the record: 29 aliases. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 79 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open