CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-22872 – Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
https://notcve.org/view.php?id=CVE-2025-22872
16 Apr 2025 — The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45338 – Non-linear parsing of case-insensitive content in golang.org/x/net/html
https://notcve.org/view.php?id=CVE-2024-45338
18 Dec 2024 — An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. A flaw was found in golang.org/x/net/html. This flaw allows an attacker to craft input to the parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This issue can cause a denial of service. • https://go.dev/cl/637536 • CWE-770: Allocation of Resources Without Limits or Throttling CWE-1333: Inefficient Regular Expression Complexity •