GO-2026-4601 Incorrect parsing of IPv6 host literals in net/url

🗓️ 06 Mar 2026 21:03:42Reported by GoogleType

osv

osv🔗 osv.dev👁 5 Views

Go URL parsing accepts invalid IPv6 host literals due to insufficient host validation.

Reporter	Title	Published	Views	Family All 2288
RedhatCVE	CVE-2026-25679	10 Mar 202618:48	–	redhatcve
RedHat Linux	Important: Red Hat Security Advisory: Red Hat Quay 3.15.5	9 Jun 202615:31	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.64 packages and security update	18 Jun 202616:16	–	redhat
RedHat Linux	net/url: Incorrect parsing of IPv6 host literals in net/url	18 Jun 202616:16	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Submariner v0.21 security fixes and container updates	10 Jun 202620:51	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.44 packages and security update	17 Jun 202607:31	–	redhat
RedHat Linux	net/url: Incorrect parsing of IPv6 host literals in net/url	17 Jun 202607:31	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: podman security update	11 Jun 202613:40	–	redhat
RedHat Linux	net/url: Incorrect parsing of IPv6 host literals in net/url	11 Jun 202613:40	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: skopeo security update	11 Jun 202613:56	–	redhat

Source	Link
go	www.go.dev/cl/752180
go	www.go.dev/issue/77578
groups	www.groups.google.com/g/golang-announce/c/EdhZqrQ98hk

17 Jul 2026 10:29Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00728

SSVC

ip version six host validation standard library go language