VDB
GO-2026-4601
GO-2026-4601
PUBLISHED
Record from OSV · Published March 6, 2026
Incorrect parsing of IPv6 host literals in net/url
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| datadog-agent-7.75 | Chainguard | 7.75.4-r5 |
| timescaledb-parallel-copy | Wolfi | 0.12.0-r8 |
| argo-events | Wolfi | 1.9.10-r5 |
| buildkite-agent | Chainguard | 3.119.2-r0 |
| beats-fips-8.19 | Chainguard | 8.19.12-r2 |
| aws-privateca-issuer | Chainguard | 1.8.0-r8 |
| scuttle-fips | Chainguard | 1.1.14-r2 |
| sbom-convert | Wolfi | 0.0.7-r13 |
| nri-jmx | Wolfi | 3.11.4-r3 |
| mongodb-kubernetes-operator | Chainguard | 0.13.0-r9 |
| kubernetes-1.35 | Wolfi | 1.35.2-r2 |
| cloud-provider-azure-fips-1.27 | Chainguard | 1.27.21-r21 |
88 more packages have a fixed version. See every fix in Lookup.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | datadog-agent-7.75 | 0 |
| wolfi | timescaledb-parallel-copy | 0 |
| wolfi | argo-events | 0 |
| chainguard | buildkite-agent | 0 |
| chainguard | beats-fips-8.19 | 0 |
| chainguard | aws-privateca-issuer | 0 |
| chainguard | scuttle-fips | 0 |
| wolfi | sbom-convert | 0 |
| wolfi | nri-jmx | 0 |
| chainguard | mongodb-kubernetes-operator | 0 |
| wolfi | kubernetes-1.35 | 0 |
| chainguard | cloud-provider-azure-fips-1.27 | 0 |
| chainguard | dex-fips | 0 |
| chainguard | secretgen-controller-fips | 0 |
| chainguard | smarter-device-manager | 0 |
| chainguard | gitness | 0 |
| chainguard | whereabouts-fips | 0 |
| wolfi | flux-image-automation-controller | 0 |
| chainguard | litestream | 0 |
| chainguard | consul-fips-1.20 | 0 |
…and 2155 more
Timeline
- Mar 6, 2026 CVE Published
- Aug 27, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GO-2026-4601
vulnetix vdb fixes GO-2026-4601Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GO-2026-4601/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart