Bug 2567938 (CVE-2026-97045)

Summary: CVE-2026-97045 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting via improper namespace handling during HTML rendering
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, abarbaro, akhatavk, akostadi, akoudelk, alebedev, alizardo, amasferr, amctagga, anjoseph, anpicker, ansmith, aoconnor, aos-team-art-private, asdas, blitton, bniver, ckandaga, cmah, cmyers, crizzo, dakwon, dhanak, dkeler, dmayorov, dnakabaa, doconnor, dpaolell, drosa, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, ehelms, flucifre, gbenhaim, gmeno, gparvin, groman, hasun, ibolton, jbalunas, jbritton, jburrell, jcantril, jchui, jdelft, jeder, jfula, jhe, jjoyce, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jowilson, jpasqual, jprabhak, jpretori, jschluet, jtolenti, jupierce, juwatts, kaycoth, kingland, kshier, ktsao, lball, lblicha, lbragsta, lchilton, lcouzens, lgamliel, lgarciaa, lhh, mbarnett, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, mhulan, mnovotny, mwringe, nboldt, ngough, niyer, nyancey, oaljalju, ogajduse, ometelka, osousa, pantinor, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, pvasanth, rbobbitt, rchan, rekumar, rhaigner, rhel-process-autobot, rjohnson, rojacob, sakbas, sausingh, sbratsla, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, sostapov, sseago, stcannon, suppawar, syedriko, thason, tsedmik, tsze, twaugh, tzivkovi, vereddy, veshanka, vkarehfa, vlaad, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam, xdharmai, yguenane, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in golang.org/x/net/html. This vulnerability allows a remote attacker to conduct Cross-Site Scripting (XSS) attacks by supplying specially crafted HTML markup. The renderer fails to properly verify namespace transitions for elements foster-parented across foreign namespaces, resulting in unescaped literal text being emitted. When re-parsed by a web browser, this malformed output can execute arbitrary script code within the user's browser session.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-05 22:37:56 UTC 
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.