The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1011 advisory.

    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts). (CVE-2025-22872)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ecs-init installed on the remote host is prior to 1.94.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-065 advisory.

    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts).

    After analysis, we have determined that 2025-22872 do not pose a security risk to docker or containerd on     Amazon Linux 2 or Amazon Linux 2023. Source code analysis using govulncheck has confirmed that these     packages do not contain the vulnerable code. As a result, no security patches are required for these     specific packages on AL2 and AL2023. (CVE-2025-22872)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4518c12e2f advisory.

    Update to version 2.10.0. Aside from the new upstream features, this update also refreshes many bundled     dependencies, fixing a few CVEs.

    https://github.com/caddyserver/caddy/releases/tag/v2.10.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-89401f2116 advisory.

    Update to version 2.10.0.  Aside from the new upstream features, this update also refreshes many bundled     dependencies, fixing a few CVEs.

    https://github.com/caddyserver/caddy/releases/tag/v2.10.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-980 advisory.

    The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line     terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a     bare LF in a chunk extension as part of the extension, this could permit request smuggling.
    (CVE-2025-22871)

    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts). (CVE-2025-22872)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-979 advisory.

    The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line     terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a     bare LF in a chunk extension as part of the extension, this could permit request smuggling.
    (CVE-2025-22871)

    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts). (CVE-2025-22872)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-981 advisory.

    The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line     terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a     bare LF in a chunk extension as part of the extension, this could permit request smuggling.
    (CVE-2025-22871)

    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts). (CVE-2025-22872)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-464c59df2a advisory.

    - Update package to release v0.24.0
    - Resolve: rhbz#2366388, rhbz#2360632
    - Upstream fixes and changes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of soci-snapshotter installed on the remote host is prior to 0.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-064 advisory.

    The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line     terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a     bare LF in a chunk extension as part of the extension, this could permit request smuggling.
    (CVE-2025-22871)

    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts). (CVE-2025-22872)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runfinch-finch installed on the remote host is prior to 1.8.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-063 advisory.

    The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line     terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a     bare LF in a chunk extension as part of the extension, this could permit request smuggling.
    (CVE-2025-22871)

    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts). (CVE-2025-22872)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nerdctl installed on the remote host is prior to 2.0.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2863 advisory.

    The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line     terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a     bare LF in a chunk extension as part of the extension, this could permit request smuggling.
    (CVE-2025-22871)

    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts). (CVE-2025-22872)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of cf-cli / cni-plugins / containerized-data-importer / docker-compose / kubevirt / packer / sriov-network- device-plugin installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-22872 advisory.

  - The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts). (CVE-2025-22872)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cf-cli / cni-plugins / containerized-data-importer / docker-compose / kubevirt / packer / sriov-network- device-plugin installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-22872 advisory.

  - The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts). (CVE-2025-22872)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
238270	Amazon Linux 2023 : ecs-init (ALAS2023-2025-1011)	Nessus	Amazon Linux Local Security Checks	medium
238255	Amazon Linux 2 : ecs-init (ALASECS-2025-065)	Nessus	Amazon Linux Local Security Checks	medium
238233	Fedora 42 : caddy (2025-4518c12e2f)	Nessus	Fedora Local Security Checks	medium
238232	Fedora 43 : caddy (2025-89401f2116)	Nessus	Fedora Local Security Checks	medium
237682	Amazon Linux 2023 : nerdctl (ALAS2023-2025-980)	Nessus	Amazon Linux Local Security Checks	medium
237674	Amazon Linux 2023 : runfinch-finch (ALAS2023-2025-979)	Nessus	Amazon Linux Local Security Checks	medium
237667	Amazon Linux 2023 : soci-snapshotter (ALAS2023-2025-981)	Nessus	Amazon Linux Local Security Checks	medium
237525	Fedora 41 : docker-buildx (2025-464c59df2a)	Nessus	Fedora Local Security Checks	medium
237517	Amazon Linux 2 : soci-snapshotter (ALASDOCKER-2025-064)	Nessus	Amazon Linux Local Security Checks	medium
237515	Amazon Linux 2 : runfinch-finch (ALASDOCKER-2025-063)	Nessus	Amazon Linux Local Security Checks	medium
237482	Amazon Linux 2 : nerdctl (ALAS-2025-2863)	Nessus	Amazon Linux Local Security Checks	medium
235289	Azure Linux 3.0 Security Update: cf-cli / cni-plugins / containerized-data-importer / docker-compose / kubevirt / packer / sriov-network-device-plugin (CVE-2025-22872)	Nessus	Azure Linux Local Security Checks	medium
235270	CBL Mariner 2.0 Security Update: cf-cli / cni-plugins / containerized-data-importer / docker-compose / kubevirt / packer / sriov-network-device-plugin (CVE-2025-22872)	Nessus	MarinerOS Local Security Checks	medium

Detections

Analytics

CVE-2025-22872

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium