CVE-2026-25679 - Vulnerability Details - OpenCVE

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Go Standard Library	Net/url

No data.

No data.

References

Link	Providers
https://go.dev/cl/752180
https://go.dev/issue/77578
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
https://pkg.go.dev/vuln/GO-2026-4601

History

Tue, 10 Mar 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 09 Mar 2026 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Go Standard Library Go Standard Library net/url
Vendors & Products		Go Standard Library Go Standard Library net/url

Fri, 06 Mar 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description		url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
Title		Incorrect parsing of IPv6 host literals in net/url
References		https://go.dev/cl/752180 https://go.dev/issue/77578 https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk https://pkg.go.dev/vuln/GO-2026-4601

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2026-03-06T21:28:14.211Z

Updated: 2026-03-10T13:37:02.459Z

Reserved: 2026-02-05T01:33:41.943Z

Link: CVE-2026-25679

Vulnrichment

Updated: 2026-03-10T13:36:57.330Z

NVD

Status : Awaiting Analysis

Published: 2026-03-06T22:16:00.720

Modified: 2026-03-10T18:18:37.740

Link: CVE-2026-25679

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25679", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-02-05T01:33:41.943Z", "datePublished": "2026-03-06T21:28:14.211Z", "dateUpdated": "2026-03-10T13:37:02.459Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-03-06T21:28:14.211Z"}, "title": "Incorrect parsing of IPv6 host literals in net/url", "descriptions": [{"lang": "en", "value": "url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."}], "affected": [{"vendor": "Go standard library", "product": "net/url", "collectionURL": "https://pkg.go.dev", "packageName": "net/url", "versions": [{"version": "0", "lessThan": "1.25.8", "status": "affected", "versionType": "semver"}, {"version": "1.26.0-0", "lessThan": "1.26.1", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "parseHost"}, {"name": "JoinPath"}, {"name": "Parse"}, {"name": "ParseRequestURI"}, {"name": "URL.Parse"}, {"name": "URL.UnmarshalBinary"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input"}]}], "references": [{"url": "https://go.dev/cl/752180"}, {"url": "https://go.dev/issue/77578"}, {"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"}, {"url": "https://pkg.go.dev/vuln/GO-2026-4601"}], "credits": [{"lang": "en", "value": "Masaki Hara (https://github.com/qnighy) of Wantedly"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T13:36:26.554241Z", "id": "CVE-2026-25679", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T13:37:02.459Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-25679", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T13:36:26.554241Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T13:36:57.330Z"}}], "cna": {"title": "Incorrect parsing of IPv6 host literals in net/url", "credits": [{"lang": "en", "value": "Masaki Hara (https://github.com/qnighy) of Wantedly"}], "affected": [{"vendor": "Go standard library", "product": "net/url", "versions": [{"status": "affected", "version": "0", "lessThan": "1.25.8", "versionType": "semver"}, {"status": "affected", "version": "1.26.0-0", "lessThan": "1.26.1", "versionType": "semver"}], "packageName": "net/url", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "parseHost"}, {"name": "JoinPath"}, {"name": "Parse"}, {"name": "ParseRequestURI"}, {"name": "URL.Parse"}, {"name": "URL.UnmarshalBinary"}]}], "references": [{"url": "https://go.dev/cl/752180"}, {"url": "https://go.dev/issue/77578"}, {"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"}, {"url": "https://pkg.go.dev/vuln/GO-2026-4601"}], "descriptions": [{"lang": "en", "value": "url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-03-06T21:28:14.211Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25679", "state": "PUBLISHED", "dateUpdated": "2026-03-10T13:37:02.459Z", "dateReserved": "2026-02-05T01:33:41.943Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-03-06T21:28:14.211Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}