OESA-2026-1793 golang security update

. Security Fixes: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which...

OESA-2026-1792 golang security update

. Security Fixes: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which...

AZL-79671 CVE-2026-25679 affecting package golang for versions less than 1.2.58-1

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...

Input validation

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse function. When new URL throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect...

CVE-2022-25295 Open Redirect

This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parser.FormValue"next" to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple...

Hostname Spoofing

Node.js is vulnerable to hostname spoofing. The hostname can be spoofed using a mixed case Javascript e.g. javAscript protocol if the node.js application uses url.parse to determine the hostname of the URL. This causes hostname-based access controls to be incorrect and allows a remote attacker to...