CVE-2025-22872

What it actually does

The tokenizer misclassifies tags with unquoted attribute values ending in / as self-closing; when Parse functions are used this places subsequent content in the wrong DOM scope, but only inside foreign content such as <math> or <svg> contexts.

Why it matters to the business

Applications that rely on the affected git packages for HTML or SVG processing may render or handle web content incorrectly, creating operational risk in environments that process untrusted markup through these tools; the long period since disclosure increases exposure window for organizations still running older RHEL 9 git packages.

How an attack unfolds

An attacker supplies specially crafted markup containing a tag with an unquoted attribute ending in / inside an SVG or MathML fragment; the tokenizer marks the tag self-closing, causing later content to be placed in the wrong scope during DOM construction and potentially altering application behavior that consumes the parsed tree.

How to fix it

Upgrade every listed package to the exact fixed version 0:2.39.3-1.el9_2 (or later) on Red Hat Enterprise Linux 9; verify the new packages are installed with rpm -q and restart any services or processes that load the git libraries.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases, then run regression tests that exercise HTML parsing of foreign-content tags with unquoted attributes ending in / to ensure correct self-closing behavior and DOM scope.

Typical attack path

1. Identify an application or workflow that uses the vulnerable git packages to parse foreign-content HTML/SVG/MathML
2. Craft a tag with an unquoted attribute value terminated by / inside the foreign-content section
3. Feed the markup through Tokenizer or Parse functions
4. Observe or trigger incorrect DOM scope assignment that leads to unexpected processing or output

How to detect it

Search application and system logs for parsing of foreign-content markup, review any custom code paths that call Tokenizer or Parse on untrusted input, and examine audit trails for unexpected DOM output or rendering anomalies after markup ingestion.

What your security team should do

• Immediately schedule the listed git package upgrades across all RHEL 9 systems
• Add the fixed package versions to patch-automation and image-building pipelines
• Scan build and runtime environments for any older git package versions still present
• Review custom tooling that invokes git's HTML parsing paths for additional hardening opportunities