Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21367-1

Опубликовано: 17 июл. 2026
Источник: suse-cvrf

Описание

Security update for lux

This update for lux fixes the following issues:

Changes in lux:

  • CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: Issues when parsing HTML files (bsc#1267110)

  • CVE-2024-45338: Denial of service due to non-linear parsing of case-insensitive content (bsc#1235304)

  • CVE-2025-22872: Incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241766)

  • CVE-2025-47911: Various algorithms with quadratic complexity when parsing HTML documents (bsc#1251460)

  • CVE-2025-58190: Excessive memory consumption (bsc#1251627) Bump x/net to 0.57.0

  • Update to 0.24.1:

    • ci: bump go version to 1.22 #1350

Список пакетов

openSUSE Leap 16.0
lux-0.24.1-bp160.1.1

Ссылки

Описание

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

Затронутые продукты
openSUSE Leap 16.0:lux-0.24.1-bp160.1.1
Ссылки

Описание

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Затронутые продукты
openSUSE Leap 16.0:lux-0.24.1-bp160.1.1
Ссылки

Описание

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Затронутые продукты
openSUSE Leap 16.0:lux-0.24.1-bp160.1.1
Ссылки

Описание

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Затронутые продукты
openSUSE Leap 16.0:lux-0.24.1-bp160.1.1
Ссылки

Описание

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Затронутые продукты
openSUSE Leap 16.0:lux-0.24.1-bp160.1.1
Ссылки

Описание

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Затронутые продукты
openSUSE Leap 16.0:lux-0.24.1-bp160.1.1
Ссылки

Описание

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Затронутые продукты
openSUSE Leap 16.0:lux-0.24.1-bp160.1.1
Ссылки

Описание

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Затронутые продукты
openSUSE Leap 16.0:lux-0.24.1-bp160.1.1
Ссылки

Описание

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Затронутые продукты
openSUSE Leap 16.0:lux-0.24.1-bp160.1.1
Ссылки
Уязвимость openSUSE-SU-2026:21367-1