RHSA-2026%3A19133

RHSA-2026%3A19133 PUBLISHED CVSS 7.800000190734863 HIGH

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.

Risk Scores

CVSS 3.1

7.800000190734863

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Red Hat	git-lfs-debuginfo-0:3.7.1-4.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10
golang
Red Hat	git-lfs-debugsource-0:3.7.1-4.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10
Red Hat	git-lfs-debugsource
Red Hat	git-lfs-0:3.7.1-4.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10
Red Hat	git-lfs-debugsource-0:3.7.1-4.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10
Red Hat	git-lfs-debugsource-0:3.7.1-4.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10
Red Hat	git-lfs
Red Hat	git-lfs-0:3.7.1-4.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
Red Hat	git-lfs-debugsource-0:3.7.1-4.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10
Red Hat	git-lfs-0:3.7.1-4.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10
Red Hat	git-lfs-0:3.7.1-4.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10
Red Hat	git-lfs-debuginfo-0:3.7.1-4.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10
Red Hat	git-lfs-0:3.7.1-4.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10
Red Hat	git-lfs-0:3.7.1-4.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10
Red Hat	git-lfs-debuginfo-0:3.7.1-4.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10

Red Hat	git-lfs-debuginfo-0:3.7.1-4.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)	3.7.1-4.el10, 3.7.1-4.el10, 3.7.1-4.el10

Timeline

May 19, 2026 CVE Published
Aug 23, 2026 CVE Updated
Aug 23, 2026 Distribution Patch
Aug 23, 2026 Distribution Patch
Aug 23, 2026 Security Advisory
Aug 23, 2026 Security Advisory
Aug 23, 2026 Security Advisory
Aug 23, 2026 Security Advisory
Aug 23, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:19133 advisory
https://access.redhat.com/security/updates/classification/#important advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2445356 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2456336 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2456338 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2456339 issue
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19133.json advisory
https://access.redhat.com/security/cve/CVE-2026-25679 advisory
https://www.cve.org/CVERecord?id=CVE-2026-25679 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-25679 advisory
https://go.dev/cl/752180 advisory
https://go.dev/issue/77578 advisory
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk advisory
https://pkg.go.dev/vuln/GO-2026-4601 advisory
https://access.redhat.com/security/cve/CVE-2026-32280 advisory
https://www.cve.org/CVERecord?id=CVE-2026-32280 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32280 advisory
https://go.dev/cl/758320 advisory
https://go.dev/issue/78282 advisory
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU advisory

…and 13 more

Open in Interactive Console →