RHSA-2025%3A9646 — Vulnetix

RHSA-2025%3A9646 PUBLISHED CVSS 7.5 HIGH

A flaw was found in golang.org/x/net/html. This flaw allows an attacker to craft input to the parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This issue can cause a denial of service.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

…and 70 more

Timeline

Jun 25, 2025 CVE Published
Apr 24, 2026 Distribution Patch
Apr 24, 2026 Distribution Patch
Apr 24, 2026 Security Advisory
Apr 24, 2026 Security Advisory
Apr 24, 2026 Security Advisory
Apr 24, 2026 Security Advisory
Jul 5, 2026 CVE Updated

References

https://access.redhat.com/errata/RHSA-2025:9646 advisory
https://access.redhat.com/security/updates/classification/#important advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
https://issues.redhat.com/browse/OADP-5905 advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9646.json advisory
https://access.redhat.com/security/cve/CVE-2024-45338 advisory
https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-45338 advisory
https://go.dev/cl/637536 advisory
https://go.dev/issue/70906 advisory
https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ advisory
https://pkg.go.dev/vuln/GO-2024-3333 advisory
https://access.redhat.com/security/cve/CVE-2025-22868 advisory
https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
https://go.dev/cl/652155 advisory
https://go.dev/issue/71490 advisory
https://pkg.go.dev/vuln/GO-2025-3488 advisory

…and 6 more

Open in Interactive Console →

Vendor	Product	Versions
Red Hat	oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b6739563bbbc01ac7f5a1423c937ce0b861e078d1fbe9fa9c202652af9ec78aa_arm64 as a component of 9Base-OADP-1.3	oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b6739563bbbc01ac7f5a1423c937ce0b861e078d1fbe9fa9c202652af9ec78aa_arm64, *, oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b6739563bbbc01ac7f5a1423c937ce0b861e078d1fbe9fa9c202652af9ec78aa_arm64
Red Hat	oadp/oadp-velero-plugin-for-aws-rhel9@sha256:99885b28c3bc08b5f7311d99d6bf4c3a8c0d43658488ab4981f668b1d77d0862_ppc64le as a component of 9Base-OADP-1.3	oadp/oadp-velero-plugin-for-aws-rhel9@sha256:99885b28c3bc08b5f7311d99d6bf4c3a8c0d43658488ab4981f668b1d77d0862_ppc64le, oadp/oadp-velero-plugin-for-aws-rhel9@sha256:99885b28c3bc08b5f7311d99d6bf4c3a8c0d43658488ab4981f668b1d77d0862_ppc64le, oadp/oadp-velero-plugin-for-aws-rhel9@sha256:99885b28c3bc08b5f7311d99d6bf4c3a8c0d43658488ab4981f668b1d77d0862_ppc64le
Red Hat	oadp/oadp-operator-bundle@sha256:9486583a82697f6df158586a6cc0a3b3dfc97d39402a0979a6290e7573b99801_amd64 as a component of 9Base-OADP-1.3	oadp/oadp-operator-bundle@sha256:9486583a82697f6df158586a6cc0a3b3dfc97d39402a0979a6290e7573b99801_amd64, oadp/oadp-operator-bundle@sha256:9486583a82697f6df158586a6cc0a3b3dfc97d39402a0979a6290e7573b99801_amd64, oadp/oadp-operator-bundle@sha256:9486583a82697f6df158586a6cc0a3b3dfc97d39402a0979a6290e7573b99801_amd64
Red Hat	oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:9617676a430141cea46deaf50f4185ae59723c187720125339f8df0dabd4579f_arm64 as a component of 9Base-OADP-1.3	, oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:9617676a430141cea46deaf50f4185ae59723c187720125339f8df0dabd4579f_arm64,
Red Hat	oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b712e88e0ec6b9c6510807793d06b7c80ad66ae3e110eaf1bb85cfb1f4ebaa0e_s390x as a component of 9Base-OADP-1.3	, , oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b712e88e0ec6b9c6510807793d06b7c80ad66ae3e110eaf1bb85cfb1f4ebaa0e_s390x
Red Hat	oadp/oadp-mustgather-rhel9@sha256:c5ee79a52f22e1dfc67dec3279b29bbba660bc7b2247a30bc0221470b3597486_ppc64le as a component of 9Base-OADP-1.3	, , *
Red Hat	oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:d4d5dd775e0eab8770787c048708eb28dc79577bc4142df8ab7799ad45cb1c36_ppc64le as a component of 9Base-OADP-1.3	oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:d4d5dd775e0eab8770787c048708eb28dc79577bc4142df8ab7799ad45cb1c36_ppc64le, *, oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:d4d5dd775e0eab8770787c048708eb28dc79577bc4142df8ab7799ad45cb1c36_ppc64le
Red Hat	oadp/oadp-velero-plugin-rhel9@sha256:57edd04953cb245d0c249c70d112c503ada950ddd3433094a8b8a3585fa350f5_arm64 as a component of 9Base-OADP-1.3	oadp/oadp-velero-plugin-rhel9@sha256:57edd04953cb245d0c249c70d112c503ada950ddd3433094a8b8a3585fa350f5_arm64, ,
Red Hat	oadp/oadp-operator-bundle@sha256:4d76c79bb02b2ef7651c9e59c5f57fa925d20ad8663b58963e15fffa2794fc70_arm64 as a component of 9Base-OADP-1.3	oadp/oadp-operator-bundle@sha256:4d76c79bb02b2ef7651c9e59c5f57fa925d20ad8663b58963e15fffa2794fc70_arm64, oadp/oadp-operator-bundle@sha256:4d76c79bb02b2ef7651c9e59c5f57fa925d20ad8663b58963e15fffa2794fc70_arm64, oadp/oadp-operator-bundle@sha256:4d76c79bb02b2ef7651c9e59c5f57fa925d20ad8663b58963e15fffa2794fc70_arm64
Red Hat	oadp/oadp-rhel9-operator@sha256:a0ce84b6445d4783faf91adf123079f12d204329f3393d92653ebe34ff6d1c19_s390x as a component of 9Base-OADP-1.3	, , *
Red Hat	oadp/oadp-velero-plugin-rhel9@sha256:6de39b90b8e736207fbc5d4d4f72d1657846a9a698b1cf9a85ef1e50698ef852_amd64 as a component of 9Base-OADP-1.3	oadp/oadp-velero-plugin-rhel9@sha256:6de39b90b8e736207fbc5d4d4f72d1657846a9a698b1cf9a85ef1e50698ef852_amd64, oadp/oadp-velero-plugin-rhel9@sha256:6de39b90b8e736207fbc5d4d4f72d1657846a9a698b1cf9a85ef1e50698ef852_amd64, *
Red Hat	oadp/oadp-velero-rhel9@sha256:5d427598650191c4484be55b8f6ba810e3ffa2d4be56503c114551dc328eccef_arm64 as a component of 9Base-OADP-1.3	oadp/oadp-velero-rhel9@sha256:5d427598650191c4484be55b8f6ba810e3ffa2d4be56503c114551dc328eccef_arm64, ,
Red Hat	oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:d15c779cf7487d3fc65c1246581dd58a275fbb1c86a56f295262971db069cce3_s390x as a component of 9Base-OADP-1.3	oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:d15c779cf7487d3fc65c1246581dd58a275fbb1c86a56f295262971db069cce3_s390x, *, oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:d15c779cf7487d3fc65c1246581dd58a275fbb1c86a56f295262971db069cce3_s390x
Red Hat	oadp/oadp-rhel9-operator@sha256:c08280477b2352694e9cbd6265fd5b5f5bf44b1d8567dadc90002e960f8b6edf_amd64 as a component of 9Base-OADP-1.3	oadp/oadp-rhel9-operator@sha256:c08280477b2352694e9cbd6265fd5b5f5bf44b1d8567dadc90002e960f8b6edf_amd64, oadp/oadp-rhel9-operator@sha256:c08280477b2352694e9cbd6265fd5b5f5bf44b1d8567dadc90002e960f8b6edf_amd64, *
Red Hat	oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:0a80d18f9bb1351b3dd2a133c3611ea3d7a5c0cc6bf53914291b638d96827a9d_ppc64le as a component of 9Base-OADP-1.3	oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:0a80d18f9bb1351b3dd2a133c3611ea3d7a5c0cc6bf53914291b638d96827a9d_ppc64le, oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:0a80d18f9bb1351b3dd2a133c3611ea3d7a5c0cc6bf53914291b638d96827a9d_ppc64le, *
Red Hat	oadp/oadp-rhel9-operator@sha256:842322ed6b054428e8e6c8b23bfd74ebd557383fce296c625f7eea4bca9fc483_ppc64le as a component of 9Base-OADP-1.3	*, oadp/oadp-rhel9-operator@sha256:842322ed6b054428e8e6c8b23bfd74ebd557383fce296c625f7eea4bca9fc483_ppc64le, oadp/oadp-rhel9-operator@sha256:842322ed6b054428e8e6c8b23bfd74ebd557383fce296c625f7eea4bca9fc483_ppc64le
Red Hat	oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b6739563bbbc01ac7f5a1423c937ce0b861e078d1fbe9fa9c202652af9ec78aa_arm64 as a component of 9Base-OADP-1.3	oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b6739563bbbc01ac7f5a1423c937ce0b861e078d1fbe9fa9c202652af9ec78aa_arm64, oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b6739563bbbc01ac7f5a1423c937ce0b861e078d1fbe9fa9c202652af9ec78aa_arm64, oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b6739563bbbc01ac7f5a1423c937ce0b861e078d1fbe9fa9c202652af9ec78aa_arm64
Red Hat	oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:e206bd7dfc2650f26201a48de67f71267d4a819298ba179327a45cef9db207be_amd64 as a component of 9Base-OADP-1.3	, oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:e206bd7dfc2650f26201a48de67f71267d4a819298ba179327a45cef9db207be_amd64,
Red Hat	oadp/oadp-velero-rhel9@sha256:145c588eb8dca79c7ea4c00bbca91ba668f2e4b9b04ac8956e1e1188bafa2266_s390x as a component of 9Base-OADP-1.3	*, oadp/oadp-velero-rhel9@sha256:145c588eb8dca79c7ea4c00bbca91ba668f2e4b9b04ac8956e1e1188bafa2266_s390x, oadp/oadp-velero-rhel9@sha256:145c588eb8dca79c7ea4c00bbca91ba668f2e4b9b04ac8956e1e1188bafa2266_s390x
Red Hat	oadp/oadp-mustgather-rhel9@sha256:5c24f2611c0780bdf2e4dd048d1dd931439528c833563e88f06ffc979f71e24f_s390x as a component of 9Base-OADP-1.3	, oadp/oadp-mustgather-rhel9@sha256:5c24f2611c0780bdf2e4dd048d1dd931439528c833563e88f06ffc979f71e24f_s390x,