{"id":"GO-2026-4601","summary":"Incorrect parsing of IPv6 host literals in net/url","details":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.","aliases":["BIT-golang-2026-25679","CVE-2026-25679"],"modified":"2026-05-21T10:29:30.199796876Z","published":"2026-03-06T21:03:42Z","related":["CGA-6v2j-7r4c-vm8g","RHSA-2026:10133","RHSA-2026:10169","RHSA-2026:10701","RHSA-2026:10712","RHSA-2026:10929","RHSA-2026:11375","RHSA-2026:11412","RHSA-2026:11413","RHSA-2026:11749","RHSA-2026:12028","RHSA-2026:12029","RHSA-2026:12030","RHSA-2026:12031","RHSA-2026:12032","RHSA-2026:12033","RHSA-2026:13508","RHSA-2026:13512","RHSA-2026:13642","RHSA-2026:13643","RHSA-2026:13671","RHSA-2026:14868","RHSA-2026:16102","RHSA-2026:16696","RHSA-2026:16875","RHSA-2026:17040","RHSA-2026:17084","RHSA-2026:17287","RHSA-2026:19017","RHSA-2026:19022","RHSA-2026:19026","RHSA-2026:19027","RHSA-2026:19031","RHSA-2026:19032","RHSA-2026:19049","RHSA-2026:19055","RHSA-2026:19126","RHSA-2026:19128","RHSA-2026:19132","RHSA-2026:19133","RHSA-2026:19135","RHSA-2026:19181","RHSA-2026:19184","RHSA-2026:19185","RHSA-2026:19207","RHSA-2026:19350","RHSA-2026:19353","RHSA-2026:19475","RHSA-2026:19634","RHSA-2026:19719","RHSA-2026:19720","RHSA-2026:19721","RHSA-2026:19750","RHSA-2026:5941","RHSA-2026:5942","RHSA-2026:5943","RHSA-2026:5944","RHSA-2026:6344","RHSA-2026:6382","RHSA-2026:6383","RHSA-2026:6388","RHSA-2026:6949","RHSA-2026:7005","RHSA-2026:7009","RHSA-2026:7011","RHSA-2026:7259","RHSA-2026:7291","RHSA-2026:7315","RHSA-2026:7328","RHSA-2026:7385","RHSA-2026:7665","RHSA-2026:7669","RHSA-2026:7674","RHSA-2026:7833","RHSA-2026:7834","RHSA-2026:7876","RHSA-2026:7877","RHSA-2026:7878","RHSA-2026:7879","RHSA-2026:7883","RHSA-2026:7992","RHSA-2026:8314","RHSA-2026:8322","RHSA-2026:8324","RHSA-2026:8434","RHSA-2026:8456","RHSA-2026:8840","RHSA-2026:8841","RHSA-2026:8842","RHSA-2026:8845","RHSA-2026:8847","RHSA-2026:8848","RHSA-2026:8849","RHSA-2026:8851","RHSA-2026:8852","RHSA-2026:8853","RHSA-2026:8855","RHSA-2026:8856","RHSA-2026:8860","RHSA-2026:8877","RHSA-2026:8878","RHSA-2026:8879","RHSA-2026:8881","RHSA-2026:8882","RHSA-2026:8930","RHSA-2026:8931","RHSA-2026:8949","RHSA-2026:9043","RHSA-2026:9044","RHSA-2026:9090","RHSA-2026:9093","RHSA-2026:9094","RHSA-2026:9097","RHSA-2026:9098","RHSA-2026:9108","RHSA-2026:9109","RHSA-2026:9434","RHSA-2026:9435","RHSA-2026:9436","RHSA-2026:9439","RHSA-2026:9695"],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-4601","review_status":"REVIEWED"},"references":[{"type":"FIX","url":"https://go.dev/cl/752180"},{"type":"REPORT","url":"https://go.dev/issue/77578"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"}],"affected":[{"package":{"name":"stdlib","ecosystem":"Go","purl":"pkg:golang/stdlib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.8"},{"introduced":"1.26.0-0"},{"fixed":"1.26.1"}]}],"ecosystem_specific":{"imports":[{"path":"net/url","symbols":["JoinPath","Parse","ParseRequestURI","URL.Parse","URL.UnmarshalBinary","parseHost"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4601.json"}}],"schema_version":"1.7.5","credits":[{"name":"Masaki Hara (https://github.com/qnighy) of Wantedly"}]}