CVE-2026-25679

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.

Red Hat evaluates this vulnerability as having an Important severity because unauthenticated remote attackers can target exposed Go services over the network to trigger severe denial-of-service conditions or validation discrepancies without requiring elevated privileges. Across standard Red Hat environments—including OpenShift Container Platform and Red Hat Enterprise Linux container tools—many components rely on the core Go runtime to process user-supplied addresses and endpoints. Although improper handling of malformed host segments in web addresses can disrupt network-facing daemons, the vulnerability cannot be leveraged for arbitrary code execution or data leakage, keeping the risk bounded within the Important classification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.