Vulnerability-Lookup

OPENSUSE-SU-2026:20058-1

Vulnerability from csaf_opensuse - Published: 2026-01-17 09:30 - Updated: 2026-01-17 09:30

Summary

Security update for go-sendxmpp

Notes

Title of the patch

Security update for go-sendxmpp

Description of the patch

This update for go-sendxmpp fixes the following issues: Changes in go-sendxmpp: - Update to 0.15.1: Added * Add XEP-0359 Origin-ID to messages (requires go-xmpp >= v0.2.18). Changed * HTTP upload: Ignore timeouts on disco IQs as some components do not reply. - Upgrades the embedded golang.org/x/net to 0.46.0 * Fixes: bsc#1251461, CVE-2025-47911: various algorithms with quadratic complexity when parsing HTML documents * Fixes: bsc#1251677, CVE-2025-58190: excessive memory consumption by 'html.ParseFragment' when processing specially crafted input - Update to 0.15.0: Added: * Add flag --verbose to show debug information. * Add flag --recipients to specify recipients by file. * Add flag --retry-connect to try after a waiting time if the connection fails. * Add flag --retry-connect-max to specify the amount of retry attempts. * Add flag --legacy-pgp for using XEP-0027 PGP encryption with Ox keys. * Add support for punycode domains. Changed: * Update gopenpgp library to v3. * Improve error detection for MUC joins. * Don't try to connect to other SRV record targets if error contains 'auth-failure'. * Remove support for old SSDP version (via go-xmpp v0.2.15). * Http-upload: Stop checking other disco items after finding upload component. * Increase default TLS version to 1.3. - bsc#1241814 (CVE-2025-22872): This update includes golang.org/x/net/html 0.43.0 - Update to 0.14.1: * Use prettier date format for error messages. * Update XEP-0474 to version 0.4.0 (requires go-xmpp >= 0.2.10). - Update to 0.14.0: Added: * Add --fast-invalidate to allow invalidating the FAST token. Changed: * Don't create legacy Ox private key directory in ~/.local/share/go-sendxmpp/oxprivkeys. * Delete legacy Ox private key directory if it's empty. * Show proper error if saved FAST mechanism isn't usable with current TLS version (requires go-xmpp >= 0.2.9). * Print debug output to stdout, not stderr (requires go-xmpp >= 0.2.9). * Show RECV: and SEND: prefix for debug output (requires go-xmpp >= 0.2.9). * Delete stored fast token if --fast-invalidate and --fast-off are set. * Show error when FAST creds are stored but non-FAST mechanism is requested. - Update to 0.13.0: Added: * Add --anonymous to support anonymous authentication (requires go-xmpp >= 0.2.8). * Add XEP-0480: SASL Upgrade Tasks support (requires go-xmpp >= 0.2.8). * Add support for see-other-host stream error (requires go-xmpp >= 0.2.8). Changed: * Don't automatically try other auth mechanisms if FAST authentication fails. - Update to 0.12.1: Changed: * Print error instead of quitting if a message of type error is received. * Allow upload of multiple files. Added: * Add flag --suppress-root-warning to suppress the warning when go-sendxmpp is used by the root user. - Update to 0.12.0: Added: * Add possibility to look up direct TLS connection endpoint via hostmeta2 (requires xmppsrv >= 0.3.3). * Add flag --allow-plain to allow PLAIN authentication (requires go-xmpp >= 0.2.5). Changed: * Disable PLAIN authentication per default. * Disable PLAIN authentication after first use of a SCRAM auth mechanism (overrides --allow-plain) (requires go-xmpp >= 0.2.5). - Update to 0.11.4: * Fix bug in SCRAM-SHA-256-PLUS (via go-xmpp >= 0.2.4). - Update to 0.11.3: * Add go-xmpp library version to --version output (requires go-xmpp >= 0.2.2). * Fix XEP-0474: SASL SCRAM Downgrade Protection hash calculation bug (via go-xmpp >= v0.2.3). * [gocritic]: Improve code quality.

Patchnames

openSUSE-Leap-16.0-packagehub-82

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for go-sendxmpp",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for go-sendxmpp fixes the following issues:\n\nChanges in go-sendxmpp:\n\n- Update to 0.15.1:\n  Added\n  * Add XEP-0359 Origin-ID to messages (requires go-xmpp \u003e= v0.2.18).\n  Changed\n  * HTTP upload: Ignore timeouts on disco IQs as some components do\n    not reply.\n- Upgrades the embedded golang.org/x/net to 0.46.0\n  * Fixes: bsc#1251461, CVE-2025-47911: various algorithms with\n    quadratic complexity when parsing HTML documents\n  * Fixes: bsc#1251677, CVE-2025-58190: excessive memory consumption\n    by \u0027html.ParseFragment\u0027 when processing specially crafted input\n\n- Update to 0.15.0:\n  Added:\n  * Add flag --verbose to show debug information.\n  * Add flag --recipients to specify recipients by file.\n  * Add flag --retry-connect to try after a waiting time if the connection fails.\n  * Add flag --retry-connect-max to specify the amount of retry attempts.\n  * Add flag --legacy-pgp for using XEP-0027 PGP encryption with Ox keys.\n  * Add support for punycode domains.\n  Changed:\n  * Update gopenpgp library to v3.\n  * Improve error detection for MUC joins.\n  * Don\u0027t try to connect to other SRV record targets if error contains \u0027auth-failure\u0027.\n  * Remove support for old SSDP version (via go-xmpp v0.2.15).\n  * Http-upload: Stop checking other disco items after finding upload component.\n  * Increase default TLS version to 1.3.\n- bsc#1241814 (CVE-2025-22872): This update includes golang.org/x/net/html 0.43.0\n\n- Update to 0.14.1:\n  * Use prettier date format for error messages.\n  * Update XEP-0474 to version 0.4.0 (requires go-xmpp \u003e= 0.2.10).\n\n- Update to 0.14.0:\n  Added:\n  * Add --fast-invalidate to allow invalidating the FAST token.\n  Changed:\n  * Don\u0027t create legacy Ox private key directory in ~/.local/share/go-sendxmpp/oxprivkeys.\n  * Delete legacy Ox private key directory if it\u0027s empty.\n  * Show proper error if saved FAST mechanism isn\u0027t usable with current TLS version (requires go-xmpp \u003e= 0.2.9).\n  * Print debug output to stdout, not stderr (requires go-xmpp \u003e= 0.2.9).\n  * Show RECV: and SEND: prefix for debug output (requires go-xmpp \u003e= 0.2.9).\n  * Delete stored fast token if --fast-invalidate and --fast-off are set.\n  * Show error when FAST creds are stored but non-FAST mechanism is requested.\n\n- Update to 0.13.0:\n  Added:\n  * Add --anonymous to support anonymous authentication (requires go-xmpp \u003e= 0.2.8).\n  * Add XEP-0480: SASL Upgrade Tasks support (requires go-xmpp \u003e= 0.2.8).\n  * Add support for see-other-host stream error (requires go-xmpp \u003e= 0.2.8).\n  Changed:\n  * Don\u0027t automatically try other auth mechanisms if FAST authentication fails.\n\n- Update to 0.12.1:\n  Changed:\n  * Print error instead of quitting if a message of type error is received.\n  * Allow upload of multiple files.\n  Added:\n  * Add flag --suppress-root-warning to suppress the warning when go-sendxmpp is used by the root user.\n\n- Update to 0.12.0:\n  Added:\n  * Add possibility to look up direct TLS connection endpoint via hostmeta2 (requires xmppsrv \u003e= 0.3.3).\n  * Add flag --allow-plain to allow PLAIN authentication (requires go-xmpp \u003e= 0.2.5).\n  Changed:\n  * Disable PLAIN authentication per default.\n  * Disable PLAIN authentication after first use of a SCRAM auth mechanism (overrides --allow-plain) (requires\n    go-xmpp \u003e= 0.2.5).\n\n- Update to 0.11.4:\n  * Fix bug in SCRAM-SHA-256-PLUS (via go-xmpp \u003e= 0.2.4).\n\n- Update to 0.11.3:\n  * Add go-xmpp library version to --version output (requires go-xmpp \u003e= 0.2.2).\n  * Fix XEP-0474: SASL SCRAM Downgrade Protection hash calculation bug (via go-xmpp \u003e= v0.2.3).\n  * [gocritic]: Improve code quality.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-82",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20058-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1241814",
        "url": "https://bugzilla.suse.com/1241814"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251461",
        "url": "https://bugzilla.suse.com/1251461"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251677",
        "url": "https://bugzilla.suse.com/1251677"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22872 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22872/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47911 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47911/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58190 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58190/"
      }
    ],
    "title": "Security update for go-sendxmpp",
    "tracking": {
      "current_release_date": "2026-01-17T09:30:33Z",
      "generator": {
        "date": "2026-01-17T09:30:33Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20058-1",
      "initial_release_date": "2026-01-17T09:30:33Z",
      "revision_history": [
        {
          "date": "2026-01-17T09:30:33Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-sendxmpp-0.15.1-bp160.1.1.aarch64",
                "product": {
                  "name": "go-sendxmpp-0.15.1-bp160.1.1.aarch64",
                  "product_id": "go-sendxmpp-0.15.1-bp160.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
                "product": {
                  "name": "go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
                  "product_id": "go-sendxmpp-0.15.1-bp160.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-sendxmpp-0.15.1-bp160.1.1.s390x",
                "product": {
                  "name": "go-sendxmpp-0.15.1-bp160.1.1.s390x",
                  "product_id": "go-sendxmpp-0.15.1-bp160.1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-sendxmpp-0.15.1-bp160.1.1.x86_64",
                "product": {
                  "name": "go-sendxmpp-0.15.1-bp160.1.1.x86_64",
                  "product_id": "go-sendxmpp-0.15.1-bp160.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-sendxmpp-0.15.1-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.aarch64"
        },
        "product_reference": "go-sendxmpp-0.15.1-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-sendxmpp-0.15.1-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.ppc64le"
        },
        "product_reference": "go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-sendxmpp-0.15.1-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.s390x"
        },
        "product_reference": "go-sendxmpp-0.15.1-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-sendxmpp-0.15.1-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.x86_64"
        },
        "product_reference": "go-sendxmpp-0.15.1-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22872",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22872"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22872",
          "url": "https://www.suse.com/security/cve/CVE-2025-22872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241710 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1241710"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-17T09:30:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22872"
    },
    {
      "cve": "CVE-2025-47911",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47911"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47911",
          "url": "https://www.suse.com/security/cve/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251308 for CVE-2025-47911",
          "url": "https://bugzilla.suse.com/1251308"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-17T09:30:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47911"
    },
    {
      "cve": "CVE-2025-58190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58190",
          "url": "https://www.suse.com/security/cve/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251309 for CVE-2025-58190",
          "url": "https://bugzilla.suse.com/1251309"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-sendxmpp-0.15.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-17T09:30:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58190"
    }
  ]
}

CVE-2025-22872 (GCVE-0-2025-22872)

Vulnerability from cvelistv5 – Published: 2025-04-16 17:13 – Updated: 2025-05-16 23:03

Title

Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

Summary

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

CWE

CWE-79

Assigner

References

URL

Tags

	https://go.dev/cl/662715
	https://go.dev/issue/73070
	https://groups.google.com/g/golang-announce/c/ezS…
	https://pkg.go.dev/vuln/GO-2025-3595

Impacted products

	Vendor	Product	Version
	golang.org/x/net	golang.org/x/net/html	Affected: 0 , < 0.38.0 (semver)

Credits

Sean Ng (https://ensy.zip)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22872",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T20:14:29.607584Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T20:15:13.433Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-05-16T23:03:07.693Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250516-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/html",
          "product": "golang.org/x/net/html",
          "programRoutines": [
            {
              "name": "Tokenizer.readStartTag"
            },
            {
              "name": "Parse"
            },
            {
              "name": "ParseFragment"
            },
            {
              "name": "ParseFragmentWithOptions"
            },
            {
              "name": "ParseWithOptions"
            },
            {
              "name": "Tokenizer.Next"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.38.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Sean Ng (https://ensy.zip)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-16T17:13:02.550Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/662715"
        },
        {
          "url": "https://go.dev/issue/73070"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3595"
        }
      ],
      "title": "Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-22872",
    "datePublished": "2025-04-16T17:13:02.550Z",
    "dateReserved": "2025-01-08T19:11:42.834Z",
    "dateUpdated": "2025-05-16T23:03:07.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-58190 (GCVE-0-2025-58190)

Vulnerability from cvelistv5 – Published: 2026-02-05 17:48 – Updated: 2026-02-05 17:48

Title

Infinite parsing loop in golang.org/x/net

Summary

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Severity ?

No CVSS data available.

CWE

CWE-835 - Loop with Unreachable Exit Condition

Assigner

References

URL

Tags

	https://groups.google.com/g/golang-announce/c/jnQ…
	https://github.com/golang/vulndb/issues/4441
	https://go.dev/cl/709875
	https://pkg.go.dev/vuln/GO-2026-4441

Impacted products

	Vendor	Product	Version
	golang.org/x/net	golang.org/x/net/html	Affected: 0 , < 0.45.0 (semver)

Credits

Guido Vranken

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/html",
          "product": "golang.org/x/net/html",
          "programRoutines": [
            {
              "name": "inRowIM"
            },
            {
              "name": "Parse"
            },
            {
              "name": "ParseFragment"
            },
            {
              "name": "ParseFragmentWithOptions"
            },
            {
              "name": "ParseWithOptions"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.45.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Guido Vranken"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-835: Loop with Unreachable Exit Condition",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-05T17:48:44.693Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c"
        },
        {
          "url": "https://github.com/golang/vulndb/issues/4441"
        },
        {
          "url": "https://go.dev/cl/709875"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4441"
        }
      ],
      "title": "Infinite parsing loop in golang.org/x/net"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-58190",
    "datePublished": "2026-02-05T17:48:44.693Z",
    "dateReserved": "2025-08-27T14:50:58.692Z",
    "dateUpdated": "2026-02-05T17:48:44.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-47911 (GCVE-0-2025-47911)

Vulnerability from cvelistv5 – Published: 2026-02-05 17:48 – Updated: 2026-02-05 17:48

Title

Quadratic parsing complexity in golang.org/x/net/html

Summary

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Severity ?

No CVSS data available.

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

References

URL

Tags

	https://go.dev/cl/709876
	https://github.com/golang/vulndb/issues/4440
	https://groups.google.com/g/golang-announce/c/jnQ…
	https://pkg.go.dev/vuln/GO-2026-4440

Impacted products

	Vendor	Product	Version
	golang.org/x/net	golang.org/x/net/html	Affected: 0 , < 0.45.0 (semver)

Credits

Guido Vranken Jakub Ciolek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/html",
          "product": "golang.org/x/net/html",
          "programRoutines": [
            {
              "name": "parser.parse"
            },
            {
              "name": "Parse"
            },
            {
              "name": "ParseFragment"
            },
            {
              "name": "ParseFragmentWithOptions"
            },
            {
              "name": "ParseWithOptions"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.45.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Guido Vranken"
        },
        {
          "lang": "en",
          "value": "Jakub Ciolek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-05T17:48:44.562Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/709876"
        },
        {
          "url": "https://github.com/golang/vulndb/issues/4440"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4440"
        }
      ],
      "title": "Quadratic parsing complexity in golang.org/x/net/html"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-47911",
    "datePublished": "2026-02-05T17:48:44.562Z",
    "dateReserved": "2025-05-13T23:31:29.597Z",
    "dateUpdated": "2026-02-05T17:48:44.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2026:20058-1

CVE-2025-22872 (GCVE-0-2025-22872)

CVE-2025-58190 (GCVE-0-2025-58190)

CVE-2025-47911 (GCVE-0-2025-47911)

Tags

Sightings

Nomenclature