It's possible to insert null character after tag opening.
vulners.com/securityvulns/securityvulns:doc:5073