{"schema_version":"1.7.5","id":"GO-2026-4601","published":"2026-03-06T21:03:42Z","modified":"2026-09-04T10:25:54.050240428Z","aliases":["BIT-golang-2026-25679","CVE-2026-25679"],"related":["CGA-6v2j-7r4c-vm8g","RHSA-2026:10133","RHSA-2026:10169","RHSA-2026:10701","RHSA-2026:10712","RHSA-2026:10929","RHSA-2026:11375","RHSA-2026:11412","RHSA-2026:11413","RHSA-2026:11749","RHSA-2026:12028","RHSA-2026:12029","RHSA-2026:12030","RHSA-2026:12031","RHSA-2026:12032","RHSA-2026:12033","RHSA-2026:13508","RHSA-2026:13512","RHSA-2026:13642","RHSA-2026:13643","RHSA-2026:13671","RHSA-2026:14868","RHSA-2026:16102","RHSA-2026:16696","RHSA-2026:16875","RHSA-2026:17040","RHSA-2026:17084","RHSA-2026:17287","RHSA-2026:19017","RHSA-2026:19022","RHSA-2026:19026","RHSA-2026:19027","RHSA-2026:19031","RHSA-2026:19032","RHSA-2026:19049","RHSA-2026:19055","RHSA-2026:19126","RHSA-2026:19128","RHSA-2026:19132","RHSA-2026:19133","RHSA-2026:19135","RHSA-2026:19181","RHSA-2026:19184","RHSA-2026:19185","RHSA-2026:19207","RHSA-2026:19350","RHSA-2026:19353","RHSA-2026:19475","RHSA-2026:19634","RHSA-2026:19719","RHSA-2026:19720","RHSA-2026:19721","RHSA-2026:19750","RHSA-2026:20581","RHSA-2026:20582","RHSA-2026:20584","RHSA-2026:21655","RHSA-2026:22450","RHSA-2026:22714","RHSA-2026:22733","RHSA-2026:22937","RHSA-2026:23228","RHSA-2026:24386","RHSA-2026:25043","RHSA-2026:25180","RHSA-2026:25248","RHSA-2026:25250","RHSA-2026:25251","RHSA-2026:25252","RHSA-2026:25253","RHSA-2026:26445","RHSA-2026:26527","RHSA-2026:26541","RHSA-2026:27076","RHSA-2026:28047","RHSA-2026:28886","RHSA-2026:28961","RHSA-2026:29035","RHSA-2026:29195","RHSA-2026:29455","RHSA-2026:29702","RHSA-2026:29703","RHSA-2026:33722","RHSA-2026:34097","RHSA-2026:34365","RHSA-2026:36317","RHSA-2026:36796","RHSA-2026:39810","RHSA-2026:41019","RHSA-2026:42150","RHSA-2026:42151","RHSA-2026:48036","RHSA-2026:49944","RHSA-2026:51288","RHSA-2026:52389","RHSA-2026:52390","RHSA-2026:52391","RHSA-2026:54191","RHSA-2026:54757","RHSA-2026:56785","RHSA-2026:56852","RHSA-2026:56910","RHSA-2026:57482","RHSA-2026:5941","RHSA-2026:5942","RHSA-2026:5943","RHSA-2026:5944","RHSA-2026:59830","RHSA-2026:60018","RHSA-2026:6344","RHSA-2026:6382","RHSA-2026:6383","RHSA-2026:6388","RHSA-2026:6949","RHSA-2026:7005","RHSA-2026:7009","RHSA-2026:7011","RHSA-2026:7259","RHSA-2026:7291","RHSA-2026:7315","RHSA-2026:7328","RHSA-2026:7385","RHSA-2026:7665","RHSA-2026:7669","RHSA-2026:7674","RHSA-2026:7833","RHSA-2026:7834","RHSA-2026:7876","RHSA-2026:7877","RHSA-2026:7878","RHSA-2026:7879","RHSA-2026:7883","RHSA-2026:7992","RHSA-2026:8314","RHSA-2026:8322","RHSA-2026:8324","RHSA-2026:8434","RHSA-2026:8456","RHSA-2026:8840","RHSA-2026:8841","RHSA-2026:8842","RHSA-2026:8845","RHSA-2026:8847","RHSA-2026:8848","RHSA-2026:8849","RHSA-2026:8851","RHSA-2026:8852","RHSA-2026:8853","RHSA-2026:8855","RHSA-2026:8856","RHSA-2026:8860","RHSA-2026:8877","RHSA-2026:8878","RHSA-2026:8879","RHSA-2026:8881","RHSA-2026:8882","RHSA-2026:8930","RHSA-2026:8931","RHSA-2026:8949","RHSA-2026:9043","RHSA-2026:9044","RHSA-2026:9090","RHSA-2026:9093","RHSA-2026:9094","RHSA-2026:9097","RHSA-2026:9098","RHSA-2026:9108","RHSA-2026:9109","RHSA-2026:9434","RHSA-2026:9435","RHSA-2026:9436","RHSA-2026:9439","RHSA-2026:9695"],"summary":"Incorrect parsing of IPv6 host literals in net/url","details":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.","affected":[{"package":{"name":"stdlib","ecosystem":"Go","purl":"pkg:golang/stdlib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.8"},{"introduced":"1.26.0-0"},{"fixed":"1.26.1"}]}],"ecosystem_specific":{"imports":[{"path":"net/url","symbols":["JoinPath","Parse","ParseRequestURI","URL.Parse","URL.UnmarshalBinary","parseHost"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4601.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/752180"},{"type":"REPORT","url":"https://go.dev/issue/77578"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-4601"},"credits":[{"name":"Masaki Hara (https://github.com/qnighy) of Wantedly"}]}