VDB
RHSA-2026%3A11688
RHSA-2026%3A11688
PUBLISHED
CVSS 7.5 HIGH
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-service-mesh/grafana-rhel8@sha256:127eeb73112e219027af60fc73f78b313ca4660b3a7c472bae711d7278d886a7_amd64 as a component of Red Hat OpenShift Service Mesh 2.6 | |
| Red Hat | registry.redhat.io/openshift-service-mesh/ratelimit-rhel8@sha256:ed56d6fb026e175877f9be146497802beb0c52bf35b11ebb3e7fce9f969f05f4_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6 | |
| Red Hat | registry.redhat.io/openshift-service-mesh/pilot-rhel8@sha256:099139a263a6ad38795c1fb9c0441289b630b2fa35925c022c4e75b541736717_amd64 as a component of Red Hat OpenShift Service Mesh 2.6 | *, registry.redhat.io/openshift-service-mesh/pilot-rhel8@sha256:099139a263a6ad38795c1fb9c0441289b630b2fa35925c022c4e75b541736717_amd64, registry.redhat.io/openshift-service-mesh/pilot-rhel8@sha256:099139a263a6ad38795c1fb9c0441289b630b2fa35925c022c4e75b541736717_amd64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-rhel8-operator@sha256:9a557accbe2e00e916ee963375318b32904a7977db79c12c323de12fdfde0fc9_arm64 as a component of Red Hat OpenShift Service Mesh 2.6 | *, *, * |
| Red Hat | ||
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-cni-rhel8@sha256:55eff6f4571c6f9ac79071da166328cff43afe999364cf3a1b6428896ea65f01_s390x as a component of Red Hat OpenShift Service Mesh 2.6 | *, *, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-cni-rhel8@sha256:fb4c5046d41ceb03b06a1cfeb6cd1e23800291fdfa63bc9f4d83a6d66319d815_amd64 as a component of Red Hat OpenShift Service Mesh 2.6 | |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-cni-rhel8@sha256:f407418a60bc916c97e83d02bb20686f830cc1669fedb9dd7da2e5aed1059567_arm64 as a component of Red Hat OpenShift Service Mesh 2.6 | |
| Red Hat | registry.redhat.io/openshift-service-mesh/grafana-rhel8@sha256:127eeb73112e219027af60fc73f78b313ca4660b3a7c472bae711d7278d886a7_amd64 as a component of Red Hat OpenShift Service Mesh 2.6 | *, registry.redhat.io/openshift-service-mesh/grafana-rhel8@sha256:127eeb73112e219027af60fc73f78b313ca4660b3a7c472bae711d7278d886a7_amd64, * |
| Red Hat | Red Hat OpenShift Service Mesh | |
| Red Hat | registry.redhat.io/openshift-service-mesh/grafana-rhel8@sha256:c8f38b059dd071540e71a5d8ca7ccdd75650dd9d6b61163920bea03d8fede00d_s390x as a component of Red Hat OpenShift Service Mesh 2.6 | registry.redhat.io/openshift-service-mesh/grafana-rhel8@sha256:c8f38b059dd071540e71a5d8ca7ccdd75650dd9d6b61163920bea03d8fede00d_s390x, registry.redhat.io/openshift-service-mesh/grafana-rhel8@sha256:c8f38b059dd071540e71a5d8ca7ccdd75650dd9d6b61163920bea03d8fede00d_s390x, registry.redhat.io/openshift-service-mesh/grafana-rhel8@sha256:c8f38b059dd071540e71a5d8ca7ccdd75650dd9d6b61163920bea03d8fede00d_s390x |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-rhel8-operator@sha256:d05d3c0323f54ba53fae5cd72ba80b352ebf4dc4140664515f3e004cada71aba_amd64 as a component of Red Hat OpenShift Service Mesh 2.6 | registry.redhat.io/openshift-service-mesh/istio-rhel8-operator@sha256:d05d3c0323f54ba53fae5cd72ba80b352ebf4dc4140664515f3e004cada71aba_amd64, registry.redhat.io/openshift-service-mesh/istio-rhel8-operator@sha256:d05d3c0323f54ba53fae5cd72ba80b352ebf4dc4140664515f3e004cada71aba_amd64, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/pilot-rhel8@sha256:d7ce936cea6082357f4849eca746af432a4082d73f76146999cbf1bba3961751_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6 | *, registry.redhat.io/openshift-service-mesh/pilot-rhel8@sha256:d7ce936cea6082357f4849eca746af432a4082d73f76146999cbf1bba3961751_ppc64le, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-cni-rhel8@sha256:8bb141f2442e991b11c3ae22a771f5f4b4c8de2f061430bcc66dc0d9fb0eb680_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6 | *, *, registry.redhat.io/openshift-service-mesh/istio-cni-rhel8@sha256:8bb141f2442e991b11c3ae22a771f5f4b4c8de2f061430bcc66dc0d9fb0eb680_ppc64le |
| Red Hat | registry.redhat.io/openshift-service-mesh/grafana-rhel8@sha256:a9dbef80d591e7bbb95681fb19183858e309a53463ee83fd6da288261b531590_arm64 as a component of Red Hat OpenShift Service Mesh 2.6 | |
| Red Hat | registry.redhat.io/openshift-service-mesh/ratelimit-rhel8@sha256:db7c7d745d2f18ac440ae62cbaa4dbda49c842253e00a4a8d36e61f843789619_arm64 as a component of Red Hat OpenShift Service Mesh 2.6 | *, *, * |
| Red Hat | OpenShift Service Mesh | |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-rhel8-operator@sha256:a7f0ac59b0f01e16a648e84611752884974f192ea6b59c36edc883662bee0145_s390x as a component of Red Hat OpenShift Service Mesh 2.6 | registry.redhat.io/openshift-service-mesh/istio-rhel8-operator@sha256:a7f0ac59b0f01e16a648e84611752884974f192ea6b59c36edc883662bee0145_s390x, registry.redhat.io/openshift-service-mesh/istio-rhel8-operator@sha256:a7f0ac59b0f01e16a648e84611752884974f192ea6b59c36edc883662bee0145_s390x, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/pilot-rhel8@sha256:d7ce936cea6082357f4849eca746af432a4082d73f76146999cbf1bba3961751_ppc64le | |
| Red Hat | registry.redhat.io/openshift-service-mesh/ratelimit-rhel8@sha256:2627fd45d7d117d3c3ea75cb1dfe8c013b2ae167faefc08053f4b794415f9ab1_amd64 as a component of Red Hat OpenShift Service Mesh 2.6 | *, *, * |
…and 13 more
Timeline
- Apr 29, 2026 CVE Published
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- Jul 22, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:11688 advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 advisory
- https://access.redhat.com/security/cve/CVE-2026-27143 advisory
- https://access.redhat.com/security/cve/CVE-2026-27144 advisory
- https://access.redhat.com/security/cve/CVE-2026-32280 advisory
- https://access.redhat.com/security/cve/CVE-2026-34986 advisory
- https://access.redhat.com/security/cve/cve-2026-25679 advisory
- https://access.redhat.com/security/cve/cve-2026-27143 advisory
- https://access.redhat.com/security/cve/cve-2026-27144 advisory
- https://access.redhat.com/security/cve/cve-2026-32280 advisory
- https://access.redhat.com/security/cve/cve-2026-34986 advisory
- https://access.redhat.com/security/updates/classification advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11688.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445356 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25679 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25679 advisory
- https://go.dev/cl/752180 advisory
- https://go.dev/issue/77578 advisory
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk advisory
…and 25 more