Source: golang-golang-x-net Version: 1:0.27.0-1 Severity: important Tags: security upstream Forwarded: https://github.com/golang/go/issues/73070 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for golang-golang-x-net. CVE-2025-22872[0]: | The tokenizer incorrectly interprets tags with unquoted attribute | values that end with a solidus character (/) as self-closing. When | directly using Tokenizer, this can result in such tags incorrectly | being marked as self-closing, and when using the Parse functions, | this can result in content following such tags as being placed in | the wrong scope during DOM construction, but only when tags are in | foreign content (e.g. <math>, <svg>, etc contexts). If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-22872 https://www.cve.org/CVERecord?id=CVE-2025-22872 [1] https://github.com/golang/go/issues/73070 [2] https://github.com/golang/net/commit/e1fcd82abba34df74614020343be8eb1fe85f0d9 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
