net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

ip-address: ip-address: Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing CIDR suffix to an IP address, an attacker can bypass the library's special-use classification methods. This misclassification can lead applications, such a...

UBUNTU-CVE-2026-54909

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

CVE-2026-18174 @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-54272 ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType classifies an address by matching it against a table of known IPv6...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-52842

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as http://attacker.com/@victim.com/ was fetched from attacker.com but treated...

Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues Update to version go1.25.12 bsc1244485. CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. CVE-2026-27142: html/template: URLs in meta content...

CVE-2026-46644

CVE-2026-46644 affects symfony/polyfill-intl-idn (1.17.1–1.38.1). The Idn::process() routine does not enforce UTS #46 rev 33 after Punycode decoding, allowing xn-- labels with empty or ASCII-only payloads to be treated as equal to their decoded form. This can enable blacklist bypass, inconsistent...

CVE-2026-10666 Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

parseipv4 in subsys/net/ip/utils.c reached via netipaddrparse for strings of the form "a.b.c.d:port" copies the port substring into a fixed 17-byte stack buffer char ipaddrNETIPV4ADDRLEN + 1 using a length of strlen - end - 1, where strlen is the full, unbounded input length and end is only the...

CVE-2026-10666

CVE-2026-10666 affects Zephyr OS: parse_ipv4() in subsys/net/ip/utils.c used by net_ipaddr_parse() for inputs like "a.b.c.d:port" copies the port substring into a fixed 17-byte buffer without validating the length, using str_len (unbounded) and end (offset of ':'). This leads to an out-of-bounds ...

Important: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: golang crypto/x509: Denial of...

AlmaLinux 9 : runc (ALSA-2026:29702)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:29702 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...