CVE-2026-25679

Description

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Affected packages (4)

• Bitnami/golangfrom 0, < 1.25.8, >= 1.26.0-0, < 1.26.1
• Debian/golang-1.25from 0, < 1.25.8-1
• Debian/golang-1.26from 0, < 1.26.1-1
• Go/stdlibfrom 0, < 1.25.8, >= 1.26.0-0, < 1.26.1

CVSS scores

References (6)

• ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-25679
• PATCHhttps://go.dev/cl/752180
• REPORThttps://go.dev/issue/77578
• WEBhttps://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
• WEBhttps://nvd.nist.gov/vuln/detail/CVE-2026-25679
• WEBhttps://pkg.go.dev/vuln/GO-2026-4601