The vulnerability of the Parse() function in the net-url component of the Go programming language allows a hacker to execute arbitrary code.

🗓️ 21 Nov 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

The Go net-url Parse() vulnerability allows remote arbitrary code execution due to improper syntax validation.

Reporter	Title	Published	Views	Family All 627
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	1 Dec 202516:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in DataStage on Cloud Pak for Data	25 Feb 202616:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	10 Mar 202612:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to incorrect parse function values in net/url (CVE-2025-47912)	14 Apr 202617:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	23 Jan 202620:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to denial of service and loss of confidentiality due to several findings in Golang binaries	19 Dec 202515:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions.	11 Dec 202515:30	–	ibm
IBM Security Bulletins	Security Bulletin: File permission modification, improper access control, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	16 Feb 202615:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow containers January 2026	30 Jan 202617:17	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities affect IBM watsonx Orchestrate with watsonx Assistant Cartridge	22 Jan 202602:58	–	ibm

Vulners

Node

OR

go goRange<1.24.8

go goRange1.25.0–1.25.2

Source	Link
github	www.github.com/zabbix/zabbix/blob/master/src/go/go.mod
pkg	www.pkg.go.dev/vuln/GO-2025-4010
go	www.go.dev/issue/75678
redos	www.redos.red-soft.ru/search/
web	www.web.nvd.nist.gov/view/vuln/detail

23 Jul 2026 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 37.5

CVSS 27.8

EPSS0.00443

go language net url package parse function remote code execution syntax validation input validation