VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Apr 16, 2025· Updated Apr 15, 2026

CVE-2025-22872

CVE-2025-22872

Description

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In golang.org/x/net/html, tags with unquoted attribute values ending in / are incorrectly treated as self-closing, leading to DOM scope errors in foreign content contexts.

Vulnerability

Description the tokenizer in the golang.org/x/net/html package (used by Go applications) incorrectly interprets HTML tags that have an unquoted attribute value ending with a solidus character (/) as self-closing [1][4]. For example, a tag like ` is tokenized as ` (self-closing) instead of an opening tag, causing the subsequent content to be placed in an incorrect scope during DOM construction [3][4].

Exploitation

Conditions This issue can be triggered when the tokenizer is used directly, affecting any tags. When using parse functions (Parse, ParseFragment, ParseFragmentWithOption, ParseWithOptions), the impact is limited to tags inside foreign content contexts such as ` or ` elements [2][3]. No authentication is specifically known to be required, but exploitation depends on processing user-supplied HTML input.

Impact

An attacker who can supply crafted HTML input (e.g., via a web application that renders user content) could cause the parser to generate an incorrect DOM tree. This may lead to misrendering in browsers or confusion in downstream logic that relies on proper DOM structure, potentially bypassing content security policies or enabling injection attacks [1][3]. The vulnerability has been assigned a CVSS v3 score of 6.5 (Medium).

Mitigation

The vulnerability is fixed in golang.org/x/net version v0.38.0 [2][3]. Users are advised to update to this release or later. There is no known workaround other than updating the dependency. The issue was reported by Sean Ng and is tracked as Go issue #73070 [3][4].

References
  1. NVD - CVE-2025-22872
  2. GO-2025-3595 - Go Packages
  3. [security] Vulnerability in golang.org/x/net
  4. x/net/html: fix CVE-2025-22872

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
golang.org/x/netGo
< 0.38.00.38.0

Affected products

4041

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.