CVE-2026-42260

Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF wit...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2025-1275)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1275 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

CVE-2025-47912

The Parse function in the Go standard library (specifically within net/url ) fails to enforce RFC 3986 requirements regarding the host component of a URL. It permits values other than IPv6 addresses to be included within square brackets, such as IPv4 addresses or hostnames . This vulnerability im...

PT-2025-42736

Name of the Vulnerable Software and Affected Versions golang versions 1.15 golang versions 1.19 Description The net/url package does not properly validate bracketed IPv6 hostnames. This can lead to issues when parsing URLs containing IPv6 addresses enclosed in brackets. Recommendations Update to ...