Skip to content

Commit 2dd65ac

Browse files
rshanm8xrshanm8x
authored
Fix x-net CVEs for caddy (#767)
Add patch for x-net - CVE-2025-47911 and CVE-2025-58190 Signed-off-by: RajeshX Shanmugam <rajesh1x.shanmugam@intel.com>
1 parent 1677c44 commit 2dd65ac

File tree

3 files changed

+217
-1
lines changed

3 files changed

+217
-1
lines changed

‎SPECS/caddy/CVE-2025-47911.patch‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
commit 59706cdaa8f95502fdec64b67b4c61d6ca58727d
2+
Author: Roland Shoemaker <roland@golang.org>
3+
Date: Mon Sep 29 16:33:18 2025 -0700
4+
5+
html: impose open element stack size limit
6+
7+
The HTML specification contains a number of algorithms which are
8+
quadratic in complexity by design. Instead of adding complicated
9+
workarounds to prevent these cases from becoming extremely expensive in
10+
pathological cases, we impose a limit of 512 to the size of the stack of
11+
open elements. It is extremely unlikely that non-adversarial HTML
12+
documents will ever hit this limit (but if we see cases of this, we may
13+
want to make the limit configurable via a ParseOption).
14+
15+
Thanks to Guido Vranken and Jakub Ciolek for both independently
16+
reporting this issue.
17+
18+
Fixes CVE-2025-47911
19+
Fixes golang/go#75682
20+
21+
Change-Id: I890517b189af4ffbf427d25d3fde7ad7ec3509ad
22+
Reviewed-on: https://go-review.googlesource.com/c/net/+/709876
23+
Reviewed-by: Damien Neil <dneil@google.com>
24+
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
25+
26+
diff --git a/vendor/golang.org/x/net/html/escape.go b/vendor/golang.org/x/net/html/escape.go
27+
index 04c6bec..12f2273 100644
28+
--- a/vendor/golang.org/x/net/html/escape.go
29+
+++ b/vendor/golang.org/x/net/html/escape.go
30+
@@ -299,7 +299,7 @@ func escape(w writer, s string) error {
31+
case '\r':
32+
esc = "&#13;"
33+
default:
34+
- panic("unrecognized escape character")
35+
+ panic("html: unrecognized escape character")
36+
}
37+
s = s[i+1:]
38+
if _, err := w.WriteString(esc); err != nil {
39+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
40+
index 722e927..88fc005 100644
41+
--- a/vendor/golang.org/x/net/html/parse.go
42+
+++ b/vendor/golang.org/x/net/html/parse.go
43+
@@ -231,7 +231,14 @@ func (p *parser) addChild(n *Node) {
44+
}
45+
46+
if n.Type == ElementNode {
47+
- p.oe = append(p.oe, n)
48+
+ p.insertOpenElement(n)
49+
+ }
50+
+}
51+
+
52+
+func (p *parser) insertOpenElement(n *Node) {
53+
+ p.oe = append(p.oe, n)
54+
+ if len(p.oe) > 512 {
55+
+ panic("html: open stack of elements exceeds 512 nodes")
56+
}
57+
}
58+
59+
@@ -810,7 +817,7 @@ func afterHeadIM(p *parser) bool {
60+
p.im = inFramesetIM
61+
return true
62+
case a.Base, a.Basefont, a.Bgsound, a.Link, a.Meta, a.Noframes, a.Script, a.Style, a.Template, a.Title:
63+
- p.oe = append(p.oe, p.head)
64+
+ p.insertOpenElement(p.head)
65+
defer p.oe.remove(p.head)
66+
return inHeadIM(p)
67+
case a.Head:
68+
@@ -2324,9 +2331,13 @@ func (p *parser) parseCurrentToken() {
69+
}
70+
}
71+
72+
-func (p *parser) parse() error {
73+
+func (p *parser) parse() (err error) {
74+
+ defer func() {
75+
+ if panicErr := recover(); panicErr != nil {
76+
+ err = fmt.Errorf("%s", panicErr)
77+
+ }
78+
+ }()
79+
// Iterate until EOF. Any other error will cause an early return.
80+
- var err error
81+
for err != io.EOF {
82+
// CDATA sections are allowed only in foreign content.
83+
n := p.oe.top()
84+
@@ -2355,6 +2366,8 @@ func (p *parser) parse() error {
85+
// <tag>s. Conversely, explicit <tag>s in r's data can be silently dropped,
86+
// with no corresponding node in the resulting tree.
87+
//
88+
+// Parse will reject HTML that is nested deeper than 512 elements.
89+
+//
90+
// The input is assumed to be UTF-8 encoded.
91+
func Parse(r io.Reader) (*Node, error) {
92+
return ParseWithOptions(r)

‎SPECS/caddy/CVE-2025-58190.patch‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
commit 6ec8895aa5f6594da7356da7d341b98133629009
2+
Author: Roland Shoemaker <roland@golang.org>
3+
Date: Mon Sep 29 19:38:24 2025 -0700
4+
5+
html: align in row insertion mode with spec
6+
7+
Update inRowIM to match the HTML specification. This fixes an issue
8+
where a specific HTML document could cause the parser to enter an
9+
infinite loop when trying to parse a </tbody> and implied </tr> next to
10+
each other.
11+
12+
Fixes CVE-2025-58190
13+
Fixes golang/go#70179
14+
15+
Change-Id: Idcb133c87c7d475cc8c7eb1f1550ea21d8bdddea
16+
Reviewed-on: https://go-review.googlesource.com/c/net/+/709875
17+
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
18+
Reviewed-by: Damien Neil <dneil@google.com>
19+
20+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
21+
index 518ee4c..722e927 100644
22+
--- a/vendor/golang.org/x/net/html/parse.go
23+
+++ b/vendor/golang.org/x/net/html/parse.go
24+
@@ -136,7 +136,7 @@ func (p *parser) indexOfElementInScope(s scope, matchTags ...a.Atom) int {
25+
return -1
26+
}
27+
default:
28+
- panic("unreachable")
29+
+ panic(fmt.Sprintf("html: internal error: indexOfElementInScope unknown scope: %d", s))
30+
}
31+
}
32+
switch s {
33+
@@ -179,7 +179,7 @@ func (p *parser) clearStackToContext(s scope) {
34+
return
35+
}
36+
default:
37+
- panic("unreachable")
38+
+ panic(fmt.Sprintf("html: internal error: clearStackToContext unknown scope: %d", s))
39+
}
40+
}
41+
}
42+
@@ -1678,7 +1678,7 @@ func inTableBodyIM(p *parser) bool {
43+
return inTableIM(p)
44+
}
45+
46+
-// Section 12.2.6.4.14.
47+
+// Section 13.2.6.4.14.
48+
func inRowIM(p *parser) bool {
49+
switch p.tok.Type {
50+
case StartTagToken:
51+
@@ -1690,7 +1690,9 @@ func inRowIM(p *parser) bool {
52+
p.im = inCellIM
53+
return true
54+
case a.Caption, a.Col, a.Colgroup, a.Tbody, a.Tfoot, a.Thead, a.Tr:
55+
- if p.popUntil(tableScope, a.Tr) {
56+
+ if p.elementInScope(tableScope, a.Tr) {
57+
+ p.clearStackToContext(tableRowScope)
58+
+ p.oe.pop()
59+
p.im = inTableBodyIM
60+
return false
61+
}
62+
@@ -1700,22 +1702,28 @@ func inRowIM(p *parser) bool {
63+
case EndTagToken:
64+
switch p.tok.DataAtom {
65+
case a.Tr:
66+
- if p.popUntil(tableScope, a.Tr) {
67+
+ if p.elementInScope(tableScope, a.Tr) {
68+
+ p.clearStackToContext(tableRowScope)
69+
+ p.oe.pop()
70+
p.im = inTableBodyIM
71+
return true
72+
}
73+
// Ignore the token.
74+
return true
75+
case a.Table:
76+
- if p.popUntil(tableScope, a.Tr) {
77+
+ if p.elementInScope(tableScope, a.Tr) {
78+
+ p.clearStackToContext(tableRowScope)
79+
+ p.oe.pop()
80+
p.im = inTableBodyIM
81+
return false
82+
}
83+
// Ignore the token.
84+
return true
85+
case a.Tbody, a.Tfoot, a.Thead:
86+
- if p.elementInScope(tableScope, p.tok.DataAtom) {
87+
- p.parseImpliedToken(EndTagToken, a.Tr, a.Tr.String())
88+
+ if p.elementInScope(tableScope, p.tok.DataAtom) && p.elementInScope(tableScope, a.Tr) {
89+
+ p.clearStackToContext(tableRowScope)
90+
+ p.oe.pop()
91+
+ p.im = inTableBodyIM
92+
return false
93+
}
94+
// Ignore the token.
95+
@@ -2222,16 +2230,20 @@ func parseForeignContent(p *parser) bool {
96+
p.acknowledgeSelfClosingTag()
97+
}
98+
case EndTagToken:
99+
+ if strings.EqualFold(p.oe[len(p.oe)-1].Data, p.tok.Data) {
100+
+ p.oe = p.oe[:len(p.oe)-1]
101+
+ return true
102+
+ }
103+
for i := len(p.oe) - 1; i >= 0; i-- {
104+
- if p.oe[i].Namespace == "" {
105+
- return p.im(p)
106+
- }
107+
if strings.EqualFold(p.oe[i].Data, p.tok.Data) {
108+
p.oe = p.oe[:i]
109+
+ return true
110+
+ }
111+
+ if i > 0 && p.oe[i-1].Namespace == "" {
112+
break
113+
}
114+
}
115+
- return true
116+
+ return p.im(p)
117+
default:
118+
// Ignore the token.
119+
}

‎SPECS/caddy/caddy.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: Web server with automatic HTTPS
44
Name: caddy
55
Version: 2.9.1
6-
Release: 19%{?dist}
6+
Release: 20%{?dist}
77
Distribution: Edge Microvisor Toolkit
88
Vendor: Intel Corporation
99
# main source code is Apache-2.0
@@ -35,6 +35,8 @@ Patch6: CVE-2025-61727.patch
3535
Patch7: CVE-2025-61729.patch
3636
Patch8: CVE-2025-47913.patch
3737
Patch9: CVE-2025-47914.patch
38+
Patch10: CVE-2025-58190.patch
39+
Patch11: CVE-2025-47911.patch
3840
# https://github.com/caddyserver/caddy/commit/2028da4e74cd41f0f7f94222c6599da1a371d4b8
3941
BuildRequires: golang >= 1.25.5
4042
# dario.cat/mergo : BSD-3-Clause
@@ -457,6 +459,9 @@ fi
457459
%{_datadir}/fish/vendor_completions.d/caddy.fish
458460

459461
%changelog
462+
* Fri Feb 13 2026 Rajesh Shanmugam <rajesh1x.shanmugam@intel.com> - 2.9.1-20
463+
- Add patch for CVE-2025-47911 and CVE-2025-58190
464+
460465
* Fri Feb 13 2026 Andy <andy.peng@intel.com> - 2.9.1-19
461466
- Update BuildRequires for golang
462467

0 commit comments

Comments
 (0)