VDB

CVE-2026-25679

CVE-2026-25679 PUBLISHED CVSS 7.5 HIGH

Incorrect parsing of IPv6 host literals in net/url

Reported by go · Published March 6, 2026

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
langfuse-2Chainguard2.95.12-r13
go-srpm-macroserrata.rockylinux.org0:3.6.0-8.el10_1.noarch
litefsChainguard0.5.14-r8
opensearch-k8s-operator-fipsChainguard2.8.0-r4
pg_timetable-fipsChainguard6.2.0-r5
apache-exporterWolfi1.0.12-r4
cert-manager-cmctlChainguard2.4.1-r3
skopeoerrata.rockylinux.org1.22.2-2.el10, 1.22.2-1.el10
traefik-fips-3.6Chainguard3.6.10-r1
prometheus-adapter-fipsChainguard0.12.0-r24
kubernetes-csi-external-resizerChainguard2.1.0-r2
pgpool2_exporterWolfi1.2.2-r15

40 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
Go standard librarynet/url0, 1.26.0-0
Red HatRed Hat OpenShift Container Platform 4.171:1.4.0-9.rhaos4.17.el8
Red HatRed Hat Enterprise Linux 7
Red HatRed Hat OpenShift Container Platform 4.191779250061
wolfiage*
Red HatRed Hat OpenShift Container Platform 4.171778709871
Red HatRed Hat OpenStack Platform 17.1 for RHEL 90:14.3.1-17.1.20260803105013.e7c7ce3.el9ost
Red HatRed Hat OpenShift Container Platform 4.121777042146
chainguardlangfuse-20
Red HatRed Hat OpenShift Container Platform 4.191779251008
Red HatRed Hat OpenShift Container Platform 4.201775084215
Red HatRed Hat OpenShift Container Platform 4.21774652160
chainguardlitefs0
chainguardopensearch-k8s-operator-fips0
chainguardpg_timetable-fips0
Red HatRed Hat OpenShift Container Platform 4.141777995498
wolfiapache-exporter0
chainguardcert-manager-cmctl0
chainguardtraefik-fips-3.60
Red HatRed Hat OpenShift Container Platform 4.131779863390

…and 5129 more

Timeline

  • Feb 19, 2026 CVE Published
  • Mar 6, 2026 PoC Published (9 in total, the first dated here)
  • Mar 7, 2026 EPSS Score (30 in total, the first dated here)
  • Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
  • Mar 27, 2026 Distribution Patch (309 in total, the first dated here)
  • Mar 27, 2026 Security Advisory (267 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-25679
vulnetix vdb fixes CVE-2026-25679

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-25679/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 241 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›