CVE-2026-25679
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - security@golang.org
- Published
- 2026-03-06
- Last modified
- 2026-09-18
- Weaknesses
- CWE-1286, CWE-425
Affected products
- Neturl (Go Standard Library)
- Go (Golang)
- Acm (Redhat)
- Advanced Cluster Security (Redhat)
- Amq Clients (Redhat)
- Amq Streams (Redhat)
- Ansible Automation Platform (Redhat)
- Apache Camel Hawtio (Redhat)
- Assisted Installer (Redhat)
- Cert Manager (Redhat)
- Certifications (Redhat)
- Confidential Compute Attestation (Redhat)
- Connectivity Link (Redhat)
- Container Native Virtualization (Redhat)
- Cryostat (Redhat)
- Deployment Validator Operator (Redhat)
- Devworkspace (Redhat)
- Edge Manager (Redhat)
- Enterprise Linux (Redhat)
- Enterprise Linux Ai (Redhat)
- Enterprise Linux Eus (Redhat)
- Ext Dns Optr (Redhat)
- External Secrets Operator (Redhat)
- Gatekeeper (Redhat)
- Hummingbird (Redhat)
- Lightspeed For Runtimes (Redhat)
- Logging (Redhat)
- Lvms (Redhat)
- Migration Toolkit Applications (Redhat)
- Mirror Registry (Redhat)
- Multicluster Engine (Redhat)
- Multicluster Globalhub (Redhat)
- Network Observ Optr (Redhat)
- Ocp Tools (Redhat)
- Openshift (Redhat)
- Openshift Ai (Redhat)
- Openshift Api Data Protection (Redhat)
- Openshift Builds (Redhat)
- Openshift Cluster Manager Cli (Redhat)
- Openshift Compliance Operator (Redhat)
- Openshift Custom Metrics Autoscaler (Redhat)
- Openshift Data Foundation (Redhat)
- Openshift Devspaces (Redhat)
- Openshift Distributed Tracing (Redhat)
- Openshift File Integrity Operator (Redhat)
- Openshift Gitops (Redhat)
- Openshift Lightspeed (Redhat)
- Openshift Pipelines (Redhat)
- Openshift Power Monitoring (Redhat)
- Openshift Security Profiles Operator (Redhat)
- Openshift Service On Aws (Redhat)
- Openstack (Redhat)
- Quay (Redhat)
- Red Hat 3scale Amp (Redhat)
- Rhdh (Redhat)
- Rhel Aus (Redhat)
- Rhel E4s (Redhat)
- Rhel Els (Redhat)
- Rhel Eus (Redhat)
- Rhel Eus Long Life (Redhat)
- Rhel Tus (Redhat)
- Rhmt (Redhat)
- Rhui (Redhat)
- Satellite (Redhat)
- Serverless (Redhat)
- Service Interconnect (Redhat)
- Service Mesh (Redhat)
- Stf (Redhat)
- Trusted Artifact Signer (Redhat)
- Webterminal (Redhat)
- Windows Machine Config (Redhat)
- Workload Availability Far (Redhat)
- Workload Availability Mdr (Redhat)
- Workload Availability Nhc (Redhat)
- Zero Trust Workload Identity Manager (Redhat)
References
- https://go.dev/cl/752180
- https://go.dev/issue/77578
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
- https://pkg.go.dev/vuln/GO-2026-4601
- https://access.redhat.com/errata/RHSA-2026:10065
- https://access.redhat.com/errata/RHSA-2026:10125
- https://access.redhat.com/errata/RHSA-2026:10133
- https://access.redhat.com/errata/RHSA-2026:10140
- https://access.redhat.com/errata/RHSA-2026:10141
- https://access.redhat.com/errata/RHSA-2026:10158
- https://access.redhat.com/errata/RHSA-2026:10169
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:10225
- https://access.redhat.com/errata/RHSA-2026:10250
- https://access.redhat.com/errata/RHSA-2026:10701
- https://access.redhat.com/errata/RHSA-2026:10712
- https://access.redhat.com/errata/RHSA-2026:10929
- https://access.redhat.com/errata/RHSA-2026:11217
- https://access.redhat.com/errata/RHSA-2026:11375
- https://access.redhat.com/errata/RHSA-2026:11412
- https://access.redhat.com/errata/RHSA-2026:11413
- https://access.redhat.com/errata/RHSA-2026:11686
- https://access.redhat.com/errata/RHSA-2026:11688
- https://access.redhat.com/errata/RHSA-2026:11747
- https://access.redhat.com/errata/RHSA-2026:11749
- https://access.redhat.com/errata/RHSA-2026:11768
- https://access.redhat.com/errata/RHSA-2026:11800
- https://access.redhat.com/errata/RHSA-2026:11856
- https://access.redhat.com/errata/RHSA-2026:11916
