VDB
RHSA-2026%3A9461
RHSA-2026%3A9461
PUBLISHED
CVSS 7.5 HIGH
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d3211fd66831bc105da8a0d004c2fc48e09d867f705e6de1ff061e935298ea7a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d3211fd66831bc105da8a0d004c2fc48e09d867f705e6de1ff061e935298ea7a_ppc64le, registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d3211fd66831bc105da8a0d004c2fc48e09d867f705e6de1ff061e935298ea7a_ppc64le, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:de3bf8bcab126df742192a3ed319aa595b3022c036391134ca4149ef711fa4f8_arm64 as a component of Red Hat OpenShift Service Mesh 3.3 | *, *, registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:de3bf8bcab126df742192a3ed319aa595b3022c036391134ca4149ef711fa4f8_arm64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:7c721b3e96083fffbede7c3e313b9a2609dd620086d8c3a6c92faa06eb78306b_amd64 as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:7c721b3e96083fffbede7c3e313b9a2609dd620086d8c3a6c92faa06eb78306b_amd64, registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:7c721b3e96083fffbede7c3e313b9a2609dd620086d8c3a6c92faa06eb78306b_amd64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3ba40d26d74d69dd664c0375ae3c170e738bf1943e9e3c550b3c969cbe1ff523_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3 | *, registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3ba40d26d74d69dd664c0375ae3c170e738bf1943e9e3c550b3c969cbe1ff523_ppc64le |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:f420d1d2f9b79a62b228035108608f0d4f7366d2d1406bd0411be658af2ea909_arm64 as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:f420d1d2f9b79a62b228035108608f0d4f7366d2d1406bd0411be658af2ea909_arm64, registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:f420d1d2f9b79a62b228035108608f0d4f7366d2d1406bd0411be658af2ea909_arm64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:de3bf8bcab126df742192a3ed319aa595b3022c036391134ca4149ef711fa4f8_arm64 as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:de3bf8bcab126df742192a3ed319aa595b3022c036391134ca4149ef711fa4f8_arm64, registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:de3bf8bcab126df742192a3ed319aa595b3022c036391134ca4149ef711fa4f8_arm64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:31ca725cb3bae79e207987ced13f766439568ddddf856c88801405d61ba51b36_amd64 as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:31ca725cb3bae79e207987ced13f766439568ddddf856c88801405d61ba51b36_amd64, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2e460362e4f7ffa961cb5da2b80a94c88e99d36da97e6e14c944d306b4d707f8_amd64 as a component of Red Hat OpenShift Service Mesh 3.3 | *, registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2e460362e4f7ffa961cb5da2b80a94c88e99d36da97e6e14c944d306b4d707f8_amd64, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b563447995234c60a4047a1b4df572048456b5220b516f3dab1cac1acfb3625f_amd64 as a component of Red Hat OpenShift Service Mesh 3.3 | *, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b563447995234c60a4047a1b4df572048456b5220b516f3dab1cac1acfb3625f_amd64, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7111cdde23558876b6846e9a60cff6609b716d0f69b42625c6e4e94faad6554c_arm64 as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7111cdde23558876b6846e9a60cff6609b716d0f69b42625c6e4e94faad6554c_arm64, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7111cdde23558876b6846e9a60cff6609b716d0f69b42625c6e4e94faad6554c_arm64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b563447995234c60a4047a1b4df572048456b5220b516f3dab1cac1acfb3625f_amd64 as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b563447995234c60a4047a1b4df572048456b5220b516f3dab1cac1acfb3625f_amd64, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b563447995234c60a4047a1b4df572048456b5220b516f3dab1cac1acfb3625f_amd64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a56b0d2625c0c74330619e1ad9c3eb9ffb950e7e159f1f30d1d13662174442bb_amd64 as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a56b0d2625c0c74330619e1ad9c3eb9ffb950e7e159f1f30d1d13662174442bb_amd64, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a56b0d2625c0c74330619e1ad9c3eb9ffb950e7e159f1f30d1d13662174442bb_amd64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:0c7b68a6a861cdc41e7bb775082158c9f6ee7bddee9b74eefb20893757d987ef_arm64 as a component of Red Hat OpenShift Service Mesh 3.3 | *, *, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:0c7b68a6a861cdc41e7bb775082158c9f6ee7bddee9b74eefb20893757d987ef_arm64 |
| Red Hat | OpenShift Service Mesh | |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:502d8f43bf950f39495738a03048c46efbe5790c6eddec7fc0e1f7d3cf016922_s390x as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:502d8f43bf950f39495738a03048c46efbe5790c6eddec7fc0e1f7d3cf016922_s390x, registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:502d8f43bf950f39495738a03048c46efbe5790c6eddec7fc0e1f7d3cf016922_s390x |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f45f7a1ddd1359010cc6dae2c03ce5ca9674c17c313470acb13094bf41bc19e9_s390x as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f45f7a1ddd1359010cc6dae2c03ce5ca9674c17c313470acb13094bf41bc19e9_s390x, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:31ca725cb3bae79e207987ced13f766439568ddddf856c88801405d61ba51b36_amd64 as a component of Red Hat OpenShift Service Mesh 3.3 | *, *, registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:31ca725cb3bae79e207987ced13f766439568ddddf856c88801405d61ba51b36_amd64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:8705c16d6828a53bd799590ddceb685f3678c6779f121a5c916aa9ecf622baf7_arm64 as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:8705c16d6828a53bd799590ddceb685f3678c6779f121a5c916aa9ecf622baf7_arm64, *, registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:8705c16d6828a53bd799590ddceb685f3678c6779f121a5c916aa9ecf622baf7_arm64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:654fe336492b1ffc23570610b598c93fcd37dca9892ea9156e3c57576041f87a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3 | *, *, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:8705c16d6828a53bd799590ddceb685f3678c6779f121a5c916aa9ecf622baf7_arm64 as a component of Red Hat OpenShift Service Mesh 3.3 | registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:8705c16d6828a53bd799590ddceb685f3678c6779f121a5c916aa9ecf622baf7_arm64, * |
…and 31 more
Timeline
- Apr 21, 2026 CVE Published
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- May 19, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:9461 advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 advisory
- https://access.redhat.com/security/cve/cve-2026-25679 advisory
- https://access.redhat.com/security/updates/classification advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9461.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445356 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25679 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25679 advisory
- https://go.dev/cl/752180 advisory
- https://go.dev/issue/77578 advisory
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk advisory
- https://pkg.go.dev/vuln/GO-2026-4601 advisory