VDB
RHSA-2026%3A11747
RHSA-2026%3A11747
PUBLISHED
CVSS 7.5 HIGH
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhoso/openstack-ovn-northd-rhel9@sha256:18b6beb34d4973461eaf6c8ac1ec55cd7c3cc1813e379af6212529dede1c8038_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | *, registry.redhat.io/rhoso/openstack-ovn-northd-rhel9@sha256:18b6beb34d4973461eaf6c8ac1ec55cd7c3cc1813e379af6212529dede1c8038_amd64, registry.redhat.io/rhoso/openstack-ovn-northd-rhel9@sha256:18b6beb34d4973461eaf6c8ac1ec55cd7c3cc1813e379af6212529dede1c8038_amd64 |
| Red Hat | registry.redhat.io/rhoso/openstack-ceilometer-ipmi-rhel9@sha256:8cd5de23389ae8b3a7daaa41f9912a97c96a1e6e7f48318018da1fd633966a3e_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | *, registry.redhat.io/rhoso/openstack-ceilometer-ipmi-rhel9@sha256:8cd5de23389ae8b3a7daaa41f9912a97c96a1e6e7f48318018da1fd633966a3e_amd64, * |
| Red Hat | registry.redhat.io/rhoso/openstack-glance-api-rhel9@sha256:d3f02a6b09298d7488259f71994866b08e8e29da0f1ae4cd5415f3dd3350384d_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | *, *, * |
| Red Hat | registry.redhat.io/rhoso/openstack-ceilometer-compute-rhel9@sha256:f4a85bda00b2b0e769271e0b589168efa4e05c2aa7165d89c40476e6e8c14d49_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | *, registry.redhat.io/rhoso/openstack-ceilometer-compute-rhel9@sha256:f4a85bda00b2b0e769271e0b589168efa4e05c2aa7165d89c40476e6e8c14d49_amd64, * |
| Red Hat | registry.redhat.io/rhoso/openstack-ceilometer-notification-rhel9@sha256:e1d32ea948cdf656ceefba5060de915abd78a41d217fe63a35d7e739003db115_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | registry.redhat.io/rhoso/openstack-ceilometer-notification-rhel9@sha256:e1d32ea948cdf656ceefba5060de915abd78a41d217fe63a35d7e739003db115_amd64, *, registry.redhat.io/rhoso/openstack-ceilometer-notification-rhel9@sha256:e1d32ea948cdf656ceefba5060de915abd78a41d217fe63a35d7e739003db115_amd64 |
| Red Hat | registry.redhat.io/rhoso/openstack-neutron-ovn-agent-rhel9@sha256:eb8fe59d00ef6174fbc4cd067b196483c1010b8c1da5fed9f23c322b4ffd5c89_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | *, registry.redhat.io/rhoso/openstack-neutron-ovn-agent-rhel9@sha256:eb8fe59d00ef6174fbc4cd067b196483c1010b8c1da5fed9f23c322b4ffd5c89_amd64, registry.redhat.io/rhoso/openstack-neutron-ovn-agent-rhel9@sha256:eb8fe59d00ef6174fbc4cd067b196483c1010b8c1da5fed9f23c322b4ffd5c89_amd64 |
| Red Hat | registry.redhat.io/rhoso-operators/infra-rhel9-operator@sha256:4e8692fc881c657f01f335e67712c7cfca1eee34d08bfbb0b4ca78c4a041fc17_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | *, *, registry.redhat.io/rhoso-operators/infra-rhel9-operator@sha256:4e8692fc881c657f01f335e67712c7cfca1eee34d08bfbb0b4ca78c4a041fc17_amd64 |
| Red Hat | registry.redhat.io/rhoso/openstack-cron-rhel9@sha256:4bac11b305314ff856d286f9096fef9aab39d79b053f9c5b53f7174078a40a99_amd64 | |
| Red Hat | registry.redhat.io/rhoso/openstack-aodh-listener-rhel9@sha256:cad30fcda3096c56d8ca3301fc38d944342441ddeb1e50f4de55ca439255e4ad_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | *, *, * |
| golang | net/url | |
| Red Hat | registry.redhat.io/rhoso/openstack-base-rhel9@sha256:9660f1397d0e62399975038f32aa4f5775e6f1ec73a7f872fc7d266cee3c53eb_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | registry.redhat.io/rhoso/openstack-base-rhel9@sha256:9660f1397d0e62399975038f32aa4f5775e6f1ec73a7f872fc7d266cee3c53eb_amd64, *, registry.redhat.io/rhoso/openstack-base-rhel9@sha256:9660f1397d0e62399975038f32aa4f5775e6f1ec73a7f872fc7d266cee3c53eb_amd64 |
| Red Hat | registry.redhat.io/rhoso/openstack-tempest-all-rhel9@sha256:d498155482e67bd90d84cd4e1b920c21a46d0eed8d662d84e010258b2f9cb934_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | registry.redhat.io/rhoso/openstack-tempest-all-rhel9@sha256:d498155482e67bd90d84cd4e1b920c21a46d0eed8d662d84e010258b2f9cb934_amd64, registry.redhat.io/rhoso/openstack-tempest-all-rhel9@sha256:d498155482e67bd90d84cd4e1b920c21a46d0eed8d662d84e010258b2f9cb934_amd64, registry.redhat.io/rhoso/openstack-tempest-all-rhel9@sha256:d498155482e67bd90d84cd4e1b920c21a46d0eed8d662d84e010258b2f9cb934_amd64 |
| Red Hat | registry.redhat.io/rhoso/openstack-manila-share-rhel9@sha256:21eb88e83b192c6b96942b62fc057baf0dc8c51eea68088f82bb24911b405c6e_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | registry.redhat.io/rhoso/openstack-manila-share-rhel9@sha256:21eb88e83b192c6b96942b62fc057baf0dc8c51eea68088f82bb24911b405c6e_amd64, *, * |
| Red Hat | registry.redhat.io/rhoso/ironic-python-agent-rhel9@sha256:f49f41cb16e02836f76ecba2163b9730667cf04ed54500c3933a4eb3e58462cf_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | registry.redhat.io/rhoso/ironic-python-agent-rhel9@sha256:f49f41cb16e02836f76ecba2163b9730667cf04ed54500c3933a4eb3e58462cf_amd64, registry.redhat.io/rhoso/ironic-python-agent-rhel9@sha256:f49f41cb16e02836f76ecba2163b9730667cf04ed54500c3933a4eb3e58462cf_amd64, * |
| Red Hat | registry.redhat.io/rhoso/openstack-placement-api-rhel9@sha256:a6bb3a85bb8ded353efe8e7c283fdb8e3b1b7b5f9016ac6650d5db41ca648089_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | registry.redhat.io/rhoso/openstack-placement-api-rhel9@sha256:a6bb3a85bb8ded353efe8e7c283fdb8e3b1b7b5f9016ac6650d5db41ca648089_amd64, registry.redhat.io/rhoso/openstack-placement-api-rhel9@sha256:a6bb3a85bb8ded353efe8e7c283fdb8e3b1b7b5f9016ac6650d5db41ca648089_amd64, registry.redhat.io/rhoso/openstack-placement-api-rhel9@sha256:a6bb3a85bb8ded353efe8e7c283fdb8e3b1b7b5f9016ac6650d5db41ca648089_amd64 |
| Red Hat | registry.redhat.io/rhoso/openstack-manila-base-rhel9@sha256:731261a4a08c06fc7572aeb201c40aab8a1044c2cc50f360458f379dcdb9b518_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | registry.redhat.io/rhoso/openstack-manila-base-rhel9@sha256:731261a4a08c06fc7572aeb201c40aab8a1044c2cc50f360458f379dcdb9b518_amd64, *, * |
| Red Hat | registry.redhat.io/rhoso/openstack-designate-api-rhel9@sha256:33d54207ed175aaf256eff690997b67a7070c96304e455974a0688c56956827a_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | *, *, registry.redhat.io/rhoso/openstack-designate-api-rhel9@sha256:33d54207ed175aaf256eff690997b67a7070c96304e455974a0688c56956827a_amd64 |
| Red Hat | registry.redhat.io/rhoso-operators/ironic-rhel9-operator@sha256:bd64a3d0e64ede0b87aa68ff06b79a6c9d3a2b2c915534a1e9054a8b080de167_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | *, registry.redhat.io/rhoso-operators/ironic-rhel9-operator@sha256:bd64a3d0e64ede0b87aa68ff06b79a6c9d3a2b2c915534a1e9054a8b080de167_amd64, registry.redhat.io/rhoso-operators/ironic-rhel9-operator@sha256:bd64a3d0e64ede0b87aa68ff06b79a6c9d3a2b2c915534a1e9054a8b080de167_amd64 |
| Red Hat | registry.redhat.io/rhoso/openstack-ceilometer-central-rhel9@sha256:207735a6c948f24ad0f4a81373cbf1c6bd28f226b67e3d6e13e71672428c42be_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | *, *, * |
| Red Hat | registry.redhat.io/rhoso/openstack-manila-scheduler-rhel9@sha256:26f85ecf8779c15ecb91c2d79438682e985d5a9bf630b3fd9403351cb8f311a1_amd64 as a component of Red Hat OpenStack Services on OpenShift 18 | *, registry.redhat.io/rhoso/openstack-manila-scheduler-rhel9@sha256:26f85ecf8779c15ecb91c2d79438682e985d5a9bf630b3fd9403351cb8f311a1_amd64, * |
…and 117 more
Timeline
- Apr 29, 2026 CVE Published
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- Jun 5, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:11747 advisory
- https://access.redhat.com/security/cve/CVE-2025-61726 advisory
- https://access.redhat.com/security/cve/CVE-2025-68121 advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://catalog.redhat.com/software/containers/search advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11747.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2434432 issue
- https://www.cve.org/CVERecord?id=CVE-2025-61726 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61726 advisory
- https://go.dev/cl/736712 advisory
- https://go.dev/issue/77101 advisory
- https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc advisory
- https://pkg.go.dev/vuln/GO-2026-4341 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2437111 issue
- https://www.cve.org/CVERecord?id=CVE-2025-68121 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-68121 advisory
- https://go.dev/cl/737700 advisory
- https://go.dev/issue/77217 advisory
- https://groups.google.com/g/golang-announce/c/K09ubi9FQFk advisory
…and 8 more