CVE-2025-22872

golang-golang-x-net: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as sel...

CVE-2025-22872 is fixed in 36 products on 1 platform, first by DEBIAN-CVE-2025-22872, released April 16, 2025. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
6.5
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0055
45th percentile

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Where it's fixed

ProductFixed inFixReleased
Linux
amazon-cloudwatch-agent · amzn 2023 1.300055.3-1.amzn2023 ALAS2023-2025-1029 Jun 18, 2025
amazon-ssm-agent · amzn 2023 3.3.3050.0-1.amzn2023 ALAS2023-2025-1202 Sep 19, 2025
apptainer · opensuse-leap 15.6 1.4.5-150600.4.12.1 SUSE-SU-2026:0439-1 Feb 11, 2026
apptainer · sles 15.7 1.4.5-150600.4.12.1 SUSE-SU-2026:0439-1 Feb 11, 2026
containerized-data-importer · sles 15.7 1.64.0-150700.9.11.1 SUSE-SU-2026:2493-1 Jun 22, 2026
containerized-data-importer1.65 · opensuse-leap 16.0 1.65.0-160000.3.1 OPENSUSE-SU-2026:21824-1 Sep 9, 2026
docker · opensuse-leap 15.6 28.2.2_ce-150000.227.1 SUSE-SU-2025:02289-1 Jul 11, 2025
docker · sles 15.6 28.2.2_ce-150000.227.1 SUSE-SU-2025:02289-1 Jul 11, 2025
docker · sles 15.7 28.2.2_ce-150000.227.1 SUSE-SU-2025:02289-1 Jul 11, 2025
docker-stable · opensuse-leap 15.6 24.0.9_ce-150000.1.22.1 SUSE-SU-2025:02289-1 Jul 11, 2025
docker-stable · sles 15.6 24.0.9_ce-150000.1.22.1 SUSE-SU-2025:02289-1 Jul 11, 2025
docker-stable · sles 15.7 24.0.9_ce-150000.1.22.1 SUSE-SU-2025:02289-1 Jul 11, 2025
ecs-init · amzn 2023 1.94.0-1.amzn2023 ALAS2023-2025-1011 Jun 4, 2025
elemental-register · opensuse-leap 16.0 1.8.1-160000.1.1 OPENSUSE-SU-2026:20132-1 Jan 29, 2026
elemental-toolkit · opensuse-leap 16.0 2.3.2-160000.1.1 OPENSUSE-SU-2026:20132-1 Jan 29, 2026
gitea-tea · opensuse-leap 16.0 0.15.1-bp160.1.1 OPENSUSE-SU-2026:21603-1 Aug 18, 2026
glab · opensuse-leap 16.0 1.114.0-bp160.1.1 OPENSUSE-SU-2026:21662-1 Aug 26, 2026
go-sendxmpp · opensuse-leap 16.0 0.15.1-bp160.1.1 OPENSUSE-SU-2026:20058-1 Jan 17, 2026
golang-go.net-dev · Ubuntu 18.04.6 LTS (bionic) 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2 golang-go.net-dev 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2 Feb 5, 2026
golang-go.net-dev · Ubuntu 20.04 LTS (focal) 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2 golang-go.net-dev 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2 Feb 5, 2026
golang-golang-x-net · Debian 13.5 (trixie) 1:0.27.0-2 DEBIAN-CVE-2025-22872 Apr 16, 2025
golang-golang-x-net · Debian 14 1:0.27.0-2 DEBIAN-CVE-2025-22872 Apr 16, 2025
golang-golang-x-net-dev · Ubuntu 18.04.6 LTS (bionic) 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2 golang-golang-x-net-dev 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2 Feb 5, 2026
golang-golang-x-net-dev · Ubuntu 20.04 LTS (focal) 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2 golang-golang-x-net-dev 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2 Feb 5, 2026
golang-golang-x-net-dev · Ubuntu 22.04.1 LTS (jammy) 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2 golang-golang-x-net-dev 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2 Feb 5, 2026
golang-golang-x-net-dev · Ubuntu 24.04.5 LTS (noble) 1:0.21.0+dfsg-1ubuntu0.1~esm2 golang-golang-x-net-dev 1:0.21.0+dfsg-1ubuntu0.1~esm2 Feb 5, 2026
grafana · opensuse-leap 15.6 11.5.5-150200.3.72.2 SUSE-SU-2025:01991-1 Jun 18, 2025
grafana · sles 15.6 11.5.5-150200.3.72.2 SUSE-SU-2025:01991-1 Jun 18, 2025
grafana · sles 15.7 11.5.5-150200.3.72.2 SUSE-SU-2025:01991-1 Jun 18, 2025
hauler · opensuse-leap 16.0 1.3.1-bp160.1.1 OPENSUSE-SU-2025:20160-1 Dec 12, 2025
helm · opensuse-leap 15.6 3.18.3-150000.1.50.1 SUSE-SU-2025:02121-1 Jun 26, 2025
helm · sles 15.6 3.18.3-150000.1.50.1 SUSE-SU-2025:02121-1 Jun 26, 2025
helm · sles 15.7 3.18.3-150000.1.50.1 SUSE-SU-2025:02121-1 Jun 26, 2025
kubernetes-old · opensuse-leap 15.6 1.31.9-150600.13.10.1 SUSE-SU-2025:01945-1 Jun 13, 2025
kubernetes-old · sles 15.6 1.31.9-150600.13.10.1 SUSE-SU-2025:01945-1 Jun 13, 2025
kubernetes-old · sles 15.7 1.31.9-150600.13.10.1 SUSE-SU-2025:01945-1 Jun 13, 2025
kubernetes1.23 · opensuse-leap 15.6 1.23.17-150500.3.21.1 SUSE-SU-2025:01940-1 Jun 13, 2025
kubernetes1.24 · opensuse-leap 15.6 1.24.17-150500.3.28.1 SUSE-SU-2025:01941-1 Jun 13, 2025
kubernetes1.25 · opensuse-leap 15.6 1.25.16-150400.9.22.1 SUSE-SU-2025:02351-1 Jul 17, 2025
kubernetes1.25 · sles 15.6 1.25.16-150400.9.22.1 SUSE-SU-2025:02351-1 Jul 17, 2025
kubernetes1.26 · opensuse-leap 15.6 1.26.15-150400.9.22.1 SUSE-SU-2025:02383-1 Jul 18, 2025
kubernetes1.26 · sles 15.6 1.26.15-150400.9.22.1 SUSE-SU-2025:02383-1 Jul 18, 2025
kubernetes1.27 · opensuse-leap 15.6 1.27.16-150400.9.16.1 SUSE-SU-2025:02336-1 Jul 16, 2025
kubernetes1.27 · sles 15.6 1.27.16-150400.9.16.1 SUSE-SU-2025:02336-1 Jul 16, 2025
kubernetes1.28 · sles 15.6 1.28.13-150400.9.14.1 SUSE-SU-2025:02350-1 Aug 1, 2025
kubevirt · opensuse-leap 15.6 1.4.1-150600.5.24.1 SUSE-SU-2025:03278-1 Sep 19, 2025
kubevirt · sles 15.6 1.4.1-150600.5.24.1 SUSE-SU-2025:03278-1 Sep 19, 2025
kubevirt · sles 15.7 1.6.3-150700.3.13.1 SUSE-SU-2025:4330-1 Dec 9, 2025
lux · opensuse-leap 16.0 0.24.1-bp160.1.1 OPENSUSE-SU-2026:21367-1 Jul 17, 2026
lxd · Ubuntu 18.04.6 LTS (bionic) 3.0.3-0ubuntu1~18.04.2+esm2 lxd 3.0.3-0ubuntu1~18.04.2+esm2 Feb 5, 2026
lxd-client · Ubuntu 18.04.6 LTS (bionic) 3.0.3-0ubuntu1~18.04.2+esm2 lxd-client 3.0.3-0ubuntu1~18.04.2+esm2 Feb 5, 2026
lxd-tools · Ubuntu 18.04.6 LTS (bionic) 3.0.3-0ubuntu1~18.04.2+esm2 lxd-tools 3.0.3-0ubuntu1~18.04.2+esm2 Feb 5, 2026
nerdctl · amzn 2023 2.0.5-1.amzn2023.0.1 ALAS2023-2025-980 May 21, 2025
prometheus-blackbox_exporter · opensuse-leap 15.6 0.26.0-150000.1.27.1 SUSE-SU-2025:01989-1 Jun 18, 2025
runfinch-finch · amzn 2023 1.8.1-1.amzn2023.0.1 ALAS2023-2025-979 May 21, 2025
soci-snapshotter · amzn 2023 0.9.0-1.amzn2023.0.3 ALAS2023-2025-981 May 21, 2025
squashfuse · opensuse-leap 15.6 0.5.0-150600.3.2.1 SUSE-SU-2026:0439-1 Feb 11, 2026
squashfuse · sles 15.7 0.5.0-150600.3.2.1 SUSE-SU-2026:0439-1 Feb 11, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.