VDB
RHSA-2026%3A11800
RHSA-2026%3A11800
PUBLISHED
CVSS 7.5 HIGH
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:892c5dcdf43882b275d59c7997cddff4a319394327ea7b5d16a074c70d7fe059_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:892c5dcdf43882b275d59c7997cddff4a319394327ea7b5d16a074c70d7fe059_s390x, *, registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:892c5dcdf43882b275d59c7997cddff4a319394327ea7b5d16a074c70d7fe059_s390x |
| Red Hat | registry.redhat.io/openshift-logging/vector-rhel9@sha256:0f703f41cee495656dcadaa90199357d748c39d56fd3d6399593337f4912dbe6_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/vector-rhel9@sha256:0f703f41cee495656dcadaa90199357d748c39d56fd3d6399593337f4912dbe6_amd64, registry.redhat.io/openshift-logging/vector-rhel9@sha256:0f703f41cee495656dcadaa90199357d748c39d56fd3d6399593337f4912dbe6_amd64, * |
| Red Hat | registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:17353255c31e79c2ec45de5367019e0fb30570a1cc3cff6be170199eeb18e4dc_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:17353255c31e79c2ec45de5367019e0fb30570a1cc3cff6be170199eeb18e4dc_amd64, registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:17353255c31e79c2ec45de5367019e0fb30570a1cc3cff6be170199eeb18e4dc_amd64 |
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:04b6062eedba3c57e099187cb627186f34f48a09df81576bbea7ac2a3e57936e_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:04b6062eedba3c57e099187cb627186f34f48a09df81576bbea7ac2a3e57936e_ppc64le, registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:04b6062eedba3c57e099187cb627186f34f48a09df81576bbea7ac2a3e57936e_ppc64le |
| Red Hat | registry.redhat.io/openshift-logging/vector-rhel9@sha256:662a7b86e69fd80fb0af5acb48ced5d889a8892548a995c7c2d6dfbf70495589_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, registry.redhat.io/openshift-logging/vector-rhel9@sha256:662a7b86e69fd80fb0af5acb48ced5d889a8892548a995c7c2d6dfbf70495589_arm64, * |
| Red Hat | registry.redhat.io/openshift-logging/vector-rhel9@sha256:cc059bf2fb6382711eb55bae8cd61e5b69304f97758ce073bc0de915a531f6cd_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:0301de23e37b680cfb4f7c7b737303f1564b5a947282590ad32c521834b0453f_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:0301de23e37b680cfb4f7c7b737303f1564b5a947282590ad32c521834b0453f_arm64, registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:0301de23e37b680cfb4f7c7b737303f1564b5a947282590ad32c521834b0453f_arm64, * |
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b33fa7578442868a978b18d9219b9deef2d30978b3788051dc7c86989f260a85_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b33fa7578442868a978b18d9219b9deef2d30978b3788051dc7c86989f260a85_amd64, registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b33fa7578442868a978b18d9219b9deef2d30978b3788051dc7c86989f260a85_amd64, * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:ca54850f60fc615b3ff7f04399173853722a42845e9a7ebae5c50e9659eab90e_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:54e5b1a076008e32574ddff8fc3a3ea9aa8cfb3c2ba2d2736c39906f15b1350d_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:54e5b1a076008e32574ddff8fc3a3ea9aa8cfb3c2ba2d2736c39906f15b1350d_s390x, registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:54e5b1a076008e32574ddff8fc3a3ea9aa8cfb3c2ba2d2736c39906f15b1350d_s390x |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:450a1302db3b38b2f63645dccd1d992a4b61e42fb375f49cd62d2af292fb54ac_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:450a1302db3b38b2f63645dccd1d992a4b61e42fb375f49cd62d2af292fb54ac_s390x, * |
| golang | Go standard library | |
| Red Hat | registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:303dbc8494a46ed4eb24a4e6ee503a5f3e791bbcd45af2576e111855514c17a9_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, *, registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:303dbc8494a46ed4eb24a4e6ee503a5f3e791bbcd45af2576e111855514c17a9_arm64 |
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:80679c65e340cced2aca6458ecfbe04f85171e0c066a39e93d44e38e444daeb1_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:7d3c287d9ac66d905624f5aefc5fe9eeadbff7868c1c31832aff74a8a0673216_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:7d3c287d9ac66d905624f5aefc5fe9eeadbff7868c1c31832aff74a8a0673216_s390x, registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:7d3c287d9ac66d905624f5aefc5fe9eeadbff7868c1c31832aff74a8a0673216_s390x, * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:328340d4d482b06ab444f435aeb9c2a43ac7177ecd1ab8eec297c56aa6467203_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | *, registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:328340d4d482b06ab444f435aeb9c2a43ac7177ecd1ab8eec297c56aa6467203_arm64, * |
| Red Hat | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:760d23df05d5ed4a370401c5bc0485ba9479312ef6628445995bfa4710b0b18b_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:760d23df05d5ed4a370401c5bc0485ba9479312ef6628445995bfa4710b0b18b_amd64, registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:760d23df05d5ed4a370401c5bc0485ba9479312ef6628445995bfa4710b0b18b_amd64, registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:760d23df05d5ed4a370401c5bc0485ba9479312ef6628445995bfa4710b0b18b_amd64 |
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:83f22ad20ad1e6c123a4f26de43095274fa4fd55d396b3bb5f74f8e2b73b01ee_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:83f22ad20ad1e6c123a4f26de43095274fa4fd55d396b3bb5f74f8e2b73b01ee_arm64, *, registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:83f22ad20ad1e6c123a4f26de43095274fa4fd55d396b3bb5f74f8e2b73b01ee_arm64 |
| Red Hat | registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:da1df9b6504750ba6c7b2187c3f4cfe9e8da8bdd32daa3fd1f7b84cc285c6394_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:da1df9b6504750ba6c7b2187c3f4cfe9e8da8bdd32daa3fd1f7b84cc285c6394_amd64, registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:da1df9b6504750ba6c7b2187c3f4cfe9e8da8bdd32daa3fd1f7b84cc285c6394_amd64, * |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a7c2417f3fd6e2e421a9551b061d90badbe0b7971282ab002d71cccd8c3bc739_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2 | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a7c2417f3fd6e2e421a9551b061d90badbe0b7971282ab002d71cccd8c3bc739_s390x, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a7c2417f3fd6e2e421a9551b061d90badbe0b7971282ab002d71cccd8c3bc739_s390x, * |
…and 15 more
Timeline
- Apr 29, 2026 CVE Published
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 19, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:11800 advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 advisory
- https://access.redhat.com/security/cve/CVE-2026-27137 advisory
- https://access.redhat.com/security/cve/CVE-2026-32829 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11800.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445356 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25679 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25679 advisory
- https://go.dev/cl/752180 advisory
- https://go.dev/issue/77578 advisory
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk advisory
- https://pkg.go.dev/vuln/GO-2026-4601 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445345 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27137 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27137 advisory
- https://go.dev/cl/752182 advisory
- https://go.dev/issue/77952 advisory
- https://pkg.go.dev/vuln/GO-2026-4599 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2448271 issue
…and 5 more