CVE-2026-25679: Incorrect parsing of IPv6 host literals in net/url
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Do not rely solely on url.Parse for untrusted input. Implement input validation and filtering before calling url.Parse: reject or sanitize malformed host/authority values (specifically malformed IPv6 host literals), and consider blocking such requests at the edge (WAF, reverse proxy, or firewall) to prevent malformed URLs from reaching application code.
- Operational
Audit all code paths that call net/url's url.Parse. Add explicit validation of the host/authority component (including IPv6 host literal syntax) prior to or after parsing, add unit/integration tests that include malformed IPv6 literals and other invalid URLs, and apply code-level fixes or input rejection where url.Parse currently accepts invalid values.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25679?
CVE-2026-25679 is considered to have a high severity due to its potential to misinterpret IPv6 addresses, leading to security vulnerabilities.
How do I fix CVE-2026-25679?
To fix CVE-2026-25679, ensure you are using an updated version of the golang/net library that addresses the parsing validation issue.
What components are affected by CVE-2026-25679?
CVE-2026-25679 affects the golang/net library specifically related to the parsing of URLs with IPv6 literals.
What impact does CVE-2026-25679 have on applications?
CVE-2026-25679 could allow attackers to exploit the invalid handling of URLs, leading to potential unauthorized access or resource misdirection.
When was CVE-2026-25679 disclosed?
CVE-2026-25679 was disclosed in 2026, bringing attention to its implications for security in applications using malformed URL parsing.