CVE-2026-25679

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...

PT-2026-28978

Уязвимость функции url.Parse компонента host/authority языка программирования Go связана с неправильной проверкой синтаксической корректности ввода. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код...

CVE-2026-25679: Direct Request

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...

curl: inconsistently Rejection Logic in file:// URLs with Authority

curl's file:// protocol handler inconsistently applies path sanitization. in reject file://../ as Bad File:// URL" but allows the same traversal when an authority/host e.g.,localhost is present file://localhost/../. this inconsistency misleads developers who rely on the bad file:// URL error for...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when validating SSH host certificate signatures. Due to a related issue in the processing of IsUserAuthority and IsHostAuthority by x/crypto/ssh, an attacker can gain unauthorized access by providing a signed SSH...

haproxy: it can lead to a situation with an attacker-controlled HTTP Host header because a mismatch between Host and authority is mishandled

haproxy was found to be vulnerable to HTTP host header attack: This problem creates a scenario in which it's possible to drop the Host header and use the authority only after forwarding to a second http2 layer, possibly causing two differing values of Host at a different stage. The highest threat...