← CVE Intelligence

CVE-2026-25679

Incorrect parsing of IPv6 host literals in net/url PUBLISHED

Description (CNA)

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Affected (CNA)

Vendor / productVersions
Go standard library / net/urlaffected 0 before 1.25.8; affected 1.26.0-0 before 1.26.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.