rpm package
opensuse/lux&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/lux&distro=openSUSE%20Tumbleweed
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-25680 | Med | 6.5 | < 0.24.1-1.1 | 0.24.1-1.1 | May 22, 2026 | Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. | |
| CVE-2025-58190 | Med | 5.3 | < 0.24.1-1.1 | 0.24.1-1.1 | Feb 5, 2026 | The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | |
| CVE-2025-47911 | Med | 5.3 | < 0.24.1-1.1 | 0.24.1-1.1 | Feb 5, 2026 | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | |
| CVE-2025-22872 | Med | 6.5 | < 0.24.1-1.1 | 0.24.1-1.1 | Apr 16, 2025 | The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can resul | |
| CVE-2024-45338 | Med | 5.3 | < 0.24.1-1.1 | 0.24.1-1.1 | Dec 18, 2024 | An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. |
- affected < 0.24.1-1.1fixed 0.24.1-1.1
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
- affected < 0.24.1-1.1fixed 0.24.1-1.1
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- affected < 0.24.1-1.1fixed 0.24.1-1.1
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- affected < 0.24.1-1.1fixed 0.24.1-1.1
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can resul
- affected < 0.24.1-1.1fixed 0.24.1-1.1
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.