net/url: Incorrect parsing of IPv6 host literals in net/url

🗓️ 18 Jun 2026 17:24:02Reported by RedHatType

redhat🔗 access.redhat.com👁 22 Views

net/url.Parse poorly validates IPv6 hosts, accepting invalid URLs by ignoring junk before the IP literal.

Reporter	Title	Published	Views	Family All 2475
RedhatCVE	CVE-2026-25679	10 Mar 202618:48	–	redhatcve
RedHat Linux	Important: Red Hat Security Advisory: git-lfs security update	27 Apr 202602:11	–	redhat
RedHat Linux	net/url: Incorrect parsing of IPv6 host literals in net/url	27 Apr 202602:11	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: rhc-worker-playbook security update	27 Apr 202613:54	–	redhat
RedHat Linux	net/url: Incorrect parsing of IPv6 host literals in net/url	27 Apr 202613:54	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: RHACS 4.8.11 security and bug fix update	27 Apr 202623:24	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat OpenShift Builds 1.7.2	28 Apr 202607:19	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: yggdrasil security update	28 Apr 202615:50	–	redhat
RedHat Linux	net/url: Incorrect parsing of IPv6 host literals in net/url	28 Apr 202615:50	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: yggdrasil-worker-package-manager security update	28 Apr 202620:36	–	redhat

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	x86_64	yggdrasil-worker-forwarder	0.0.3-5.el8sat	yggdrasil-worker-forwarder-0.0.3-5.el8sat.x86_64.rpm
Red Hat Enterprise Linux	9	x86_64	yggdrasil-worker-forwarder	0.0.3-5.el9sat	yggdrasil-worker-forwarder-0.0.3-5.el9sat.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-25679
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/752180
go	www.go.dev/issue/77578
groups	www.groups.google.com/g/golang-announce/c/EdhZqrQ98hk
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-25679
pkg	www.pkg.go.dev/vuln/GO-2026-4601
cve	www.cve.org/CVERecord

05 Sep 2026 13:24Current

7.9High risk

Vulners AI Score7.9

CVSS 3.17.5

EPSS0.00728

SSVC

ipv6 literals url parsing validation failure invalid urls go library