net/url: Incorrect parsing of IPv6 host literals in net/url

🗓️ 15 Jul 2026 09:55:31Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

net/url.Parse incorrectly validates IPv6 hosts, accepts invalid URLs; should reject.

Reporter	Title	Published	Views	Family All 2291
RedhatCVE	CVE-2026-25679	10 Mar 202618:48	–	redhatcve
RedHat Linux	net/url: Incorrect parsing of IPv6 host literals in net/url	4 Jun 202613:27	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Multicluster Global Hub 1.6.2 security update	4 Jun 202614:16	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: podman security update	8 Jun 202613:14	–	redhat
RedHat Linux	net/url: Incorrect parsing of IPv6 host literals in net/url	8 Jun 202613:14	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat Quay 3.15.5	9 Jun 202615:31	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.64 packages and security update	18 Jun 202616:16	–	redhat
RedHat Linux	net/url: Incorrect parsing of IPv6 host literals in net/url	18 Jun 202616:16	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Submariner v0.21 security fixes and container updates	10 Jun 202620:51	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.44 packages and security update	17 Jun 202607:31	–	redhat

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9	x86_64	golang-github-openstack-k8s-operators-os-diff	0.1.1-18.0.20260602234716.a95ae05.el9ost	golang-github-openstack-k8s-operators-os-diff-0.1.1-18.0.20260602234716.a95ae05.el9ost.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-25679
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/752180
go	www.go.dev/issue/77578
groups	www.groups.google.com/g/golang-announce/c/EdhZqrQ98hk
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-25679
pkg	www.pkg.go.dev/vuln/GO-2026-4601
cve	www.cve.org/CVERecord

20 Jul 2026 04:43Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.00728

SSVC

internet protocol host validation url parsing