Input validation error in Go programming language - CVE-2026-25679

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU124118

Input validation error in Go programming language - CVE-2026-25679

Published: March 19, 2026


Vulnerability identifier: #VU124118
CSH Severity: Medium
CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2026-25679
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass URL parsing validation and potentially access unintended resources.

The vulnerability exists due to insufficient validation in net/url.Parse when handling IPv6 literals not located at the start of the host component. A remote attacker can send a specially crafted URL with an IPv6 literal preceded by garbage characters to bypass proper parsing and potentially redirect requests.

This issue affects any application using net/url.Parse to process untrusted URLs. The incorrect parsing may lead to misrouting or injection of unintended host components.


Affected software

Go programming language
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Development Tools Module
openSUSE Leap
openEuler
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
OpenShift Logging
Red Hat OpenStack
DataStage on Cloud Pak for Data
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
rhc (Red Hat package)
rhc-worker-playbook (Red Hat package)
yggdrasil-worker-package-manager (Red Hat package)
yggdrasil (Red Hat package)
gvisor-tap-vsock (Red Hat package)
golang-github-openprinting-ipp-usb (Red Hat package)
opentelemetry-collector (Red Hat package)
containernetworking-plugins (Red Hat package)
runc (Red Hat package)
skopeo (Red Hat package)
golang-help
golang-devel
golang
golang (Red Hat package)
go-toolset
golang-bin
golang-tests
golang-src
golang-misc
golang-docs
golang-shared
delve
delve (Red Hat package)
golang-race
go1.25-openssl
go1.25-openssl-doc
go1.25-openssl-debuginfo
go1.25-openssl-race
go1.25-race
go1.25
go1.25-doc
go1.26-openssl
go1.26-openssl-race
go1.26-openssl-doc
go1.26-doc
go1.26
go1.26-race
buildah (Red Hat package)
git-lfs (Red Hat package)
grafana-pcp (Red Hat package)
git-lfs-doc
git-lfs
etcd (Red Hat package)
go-rpm-macros (Red Hat package)
kata-containers (Red Hat package)
podman (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
grafana-pcp
grafana (Red Hat package)
grafana-selinux
grafana
image-builder (Red Hat package)
osbuild-composer (Red Hat package)
osbuild-composer-worker
osbuild-composer-core
osbuild-composer
Red Hat OpenShift Container Platform

How to mitigate CVE-2026-25679

Install security update from vendor's website.

Go programming language - addressed in versions 1.25.8, 1.26.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3.1 Patch 5
DataStage on Cloud Pak for Data - update to 5.3.1 patch 7
rhc (Red Hat package) - addressed in versions 0.2.0-6.el8_4, 0.2.1-13.el9_0, 0.2.1-14.el8_6, 0.2.2-1.el8_8.2, 0.2.2-1.el9_2.2, 0.2.4-5.el7_9, 0.2.4-7.el9_4, 0.2.5-5.el8_10, 0.2.7-1.el9_6.2, 0.2.7-3.el9_7, 0.3.2-3.el10_0, 0.3.4-3.el10_1
rhc-worker-playbook (Red Hat package) - addressed in versions 0.2.3-4.el10_0, 0.2.3-4.el10_1
yggdrasil-worker-package-manager (Red Hat package) - addressed in versions 0.2.3-5.el10_0, 0.2.3-5.el10_1
yggdrasil (Red Hat package) - addressed in versions 0.4.7-3.el10_0, 0.4.8-4.el10_1
gvisor-tap-vsock (Red Hat package) - addressed in versions 0.7.3-5.el9_4.3, 0.8.5-2.el9_6.1, 0.8.5-2.el10_0.1
golang-github-openprinting-ipp-usb (Red Hat package) - addressed in versions 0.9.27-3.el10_0.3, 0.9.27-5.el10_1.1
opentelemetry-collector (Red Hat package) - addressed in versions 0.144.0-2.el9_4, 0.144.0-2.el9_6, 0.144.0-2.el10_0
containernetworking-plugins (Red Hat package) - addressed in versions 1.2.0-3.el9_2.3, 1.4.0-6.rhaos4.14.el8, 1.4.0-6.rhaos4.15.el8, 1.4.0-7.rhaos4.13.el8, 1.6.2-3.el9_6
runc (Red Hat package) - addressed in versions 1.2.9-1.el9_2.2, 1.2.9-1.el9_4.1, 1.2.9-3.el9_6, 1.2.9-4.rhaos4.16.el9, 1.4.2-2.el9_8
skopeo (Red Hat package) - addressed in versions 1.11.3-6.rhaos4.13.el8, 1.11.3-6.rhaos4.13.el9, 1.11.3-7.rhaos4.14.el8, 1.11.3-7.rhaos4.14.el9, 1.11.3-8.rhaos4.15.el8, 1.11.3-9.rhaos4.15.el9, 1.11.4-0.1.el9_2.6, 1.14.5-2.el9_4.4, 1.14.5-7.rhaos4.16.el9, 1.18.1-3.el10_0.1, 1.18.1-5.el9_6, 1.22.2-2.el10_2
golang-help - addressed in versions 1.15.7-60, 1.17.3-48, 1.21.4-43, 1.21.4-44, 1.21.4-46
golang-devel - addressed in versions 1.15.7-60, 1.17.3-48, 1.21.4-43, 1.21.4-44, 1.21.4-46
golang - addressed in versions 1.15.7-60, 1.17.3-48, 1.21.4-43, 1.21.4-44, 1.21.4-46
golang (Red Hat package) - addressed in versions 1.17.13-11.el9_0, 1.19.13-24.el9_2, 1.25.8-1.el9_6, 1.25.8-1.el9_7, 1.25.8-1.el10_1
go-toolset - addressed in versions 1.24.6-1, 1.25.8-1.0.1
golang-bin - addressed in versions 1.24.13-2, 1.25.8-1.0.1
golang-tests - addressed in versions 1.24.13-2, 1.25.8-1.0.1
golang-src - addressed in versions 1.24.13-2, 1.25.8-1.0.1
golang-misc - addressed in versions 1.24.13-2, 1.25.8-1.0.1
golang-docs - addressed in versions 1.24.13-2, 1.25.8-1.0.1
golang-shared - update to 1.24.13-2
golang - addressed in versions 1.24.13-2, 1.25.8-1.0.1
delve - update to 1.25.2-1.0.2
delve (Red Hat package) - addressed in versions 1.25.2-3.el10_0, 1.25.2-3.el10_1
golang-race - update to 1.25.8-1.0.1
go1.25-openssl - addressed in versions 1.25.8-150000.1.18.1, 1.25.8-150600.13.15.1, 1.25.12-150000.1.27.1, 1.25.12-150600.13.21.1
go1.25-openssl-doc - addressed in versions 1.25.8-150000.1.18.1, 1.25.8-150600.13.15.1, 1.25.12-150000.1.27.1, 1.25.12-150600.13.21.1
go1.25-openssl-debuginfo - addressed in versions 1.25.8-150000.1.18.1, 1.25.8-150600.13.15.1, 1.25.12-150000.1.27.1, 1.25.12-150600.13.21.1
go1.25-openssl-race - addressed in versions 1.25.8-150000.1.18.1, 1.25.8-150600.13.15.1, 1.25.12-150000.1.27.1, 1.25.12-150600.13.21.1
go1.25-race - addressed in versions 1.25.8-150000.1.32.1, 1.25.12-150000.1.44.1
go1.25 - addressed in versions 1.25.8-150000.1.32.1, 1.25.12-150000.1.44.1
go1.25-doc - addressed in versions 1.25.8-150000.1.32.1, 1.25.12-150000.1.44.1
go1.26-openssl - addressed in versions 1.26.1-150000.1.3.1, 1.26.1-150600.13.3.1
go1.26-openssl-race - addressed in versions 1.26.1-150000.1.3.1, 1.26.1-150600.13.3.1
go1.26-openssl-doc - addressed in versions 1.26.1-150000.1.3.1, 1.26.1-150600.13.3.1
go1.26-doc - update to 1.26.1-150000.1.6.1
go1.26 - update to 1.26.1-150000.1.6.1
go1.26-race - update to 1.26.1-150000.1.6.1
buildah (Red Hat package) - addressed in versions 1.26.11-1.el9_0, 1.29.7-1.el9_2.5, 1.39.6-2.el9_6, 1.39.8-1.el10_0, 1.43.1-2.el10_2
git-lfs (Red Hat package) - addressed in versions 2.13.3-3.el8_4.5, 2.13.3-3.el8_6.7, 2.13.3-5.el9_0.7, 3.2.0-2.el9_2.6, 3.4.1-4.el9_4.5, 3.4.1-10.el8_10, 3.6.1-2.el9_6.3, 3.6.1-2.el10_0.3, 3.6.1-8.el9_7
grafana-pcp (Red Hat package) - addressed in versions 3.0.2-4.el8_4, 3.2.0-4.el8_6, 3.2.0-6.el8_8, 3.2.0-6.el9_0, 5.1.1-5.el9_2, 5.1.1-13.el9_6, 5.1.1-13.el9_7, 5.2.2-5.el10_0, 5.3.0-3.el10_1
git-lfs-doc - update to 3.4.1-10.0.1
git-lfs - update to 3.4.1-10.0.1
etcd (Red Hat package) - update to 3.4.26-9.5.el9ost
go-rpm-macros (Red Hat package) - addressed in versions 3.6.0-8.el10_1, 3.6.0-13.el9_6, 3.6.0-14.el9_7
kata-containers (Red Hat package) - update to 3.25.0-6.rhaos4.18.el9
podman (Red Hat package) - addressed in versions 4.4.1-19.rhaos4.13.el8, 4.4.1-20.rhaos4.13.el9, 4.4.1-22.el9_2.11, 4.4.1-25.rhaos4.14.el8, 4.4.1-25.rhaos4.14.el9, 4.4.1-39.rhaos4.15.el8, 4.9.4-20.el9_4.2, 5.4.0-15.el10_0.1, 5.4.0-20.el9_6.3, 5.8.2-2.el9_8, 5.8.2-2.el10_2
Red Hat OpenShift Container Platform - addressed in versions 4.13.68, 4.14.68, 4.15.66, 4.16.64, 4.18.44
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.14.0-202606041348.p2.g9a7820e.assembly.stream.el8, 4.14.0-202606041348.p2.g9a7820e.assembly.stream.el9, 4.15.0-202606040938.p2.gfd77d92.assembly.stream.el8, 4.15.0-202606040938.p2.gfd77d92.assembly.stream.el9, 4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8, 4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9, 4.18.0-202606021914.p2.gc395190.assembly.stream.el8, 4.18.0-202606021914.p2.gc395190.assembly.stream.el9
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202606040938.p2.g0d799a2.assembly.stream.el8, 4.15.0-202606040938.p2.g0d799a2.assembly.stream.el9, 4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8, 4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9, 4.18.0-202606021914.p2.g9c24d76.assembly.stream.el8, 4.18.0-202606021914.p2.g9c24d76.assembly.stream.el9
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202606040938.p2.gfc50272.assembly.stream.el8, 4.15.0-202606040938.p2.gfc50272.assembly.stream.el9, 4.16.0-202606031028.p2.g26b43df.assembly.stream.el8, 4.16.0-202606031028.p2.g26b43df.assembly.stream.el9, 4.18.0-202606021914.p2.g6ea2356.assembly.stream.el8, 4.18.0-202606021914.p2.g6ea2356.assembly.stream.el9
grafana-pcp - update to 5.1.1-13
OpenShift Logging - update to 6.0.15
grafana (Red Hat package) - addressed in versions 6.3.6-11.el8_2, 7.3.6-13.el8_4, 7.5.15-10.el8_8, 9.2.10-26.el9_4, 10.2.6-19.el9_6, 10.2.6-19.el9_7, 10.2.6-22.el10_0, 10.2.6-23.el10_1
grafana-selinux - update to 9.2.10-29.0.1
grafana - update to 9.2.10-29.0.1
Red Hat OpenStack - update to 17.1
image-builder (Red Hat package) - addressed in versions 31-4.el9_7, 52.1-1.el10_2
osbuild-composer (Red Hat package) - addressed in versions 101.3-4.el9_4.1, 101.4-5.el8_10, 132.2-6.el9_6, 134.1-7.el10_0, 149-5.el9_7
osbuild-composer-worker - update to 149-5
osbuild-composer-core - update to 149-5
osbuild-composer - update to 149-5

External References

Related Security Bulletins