Executive brief
A vulnerability exists in the Go programming language's standard library for handling web addresses (URLs). The software fails to properly validate certain parts of a URL, specifically when processing IPv6 addresses that contain unexpected characters. This could allow an attacker to cause a denial-of-service condition or potentially bypass security filters in applications that rely on this library to verify web links.
Technical details
A vulnerability in the net/url.Parse function of the Go standard library arises from improper validation of the host subcomponent. The parser fails to reject IPv6 literals that do not appear at the start of the host string, effectively ignoring 'garbage' characters preceding the IP literal. This flaw can be exploited by a remote, unauthenticated attacker providing specially crafted URLs to applications that use affected symbols like Parse, JoinPath, or UnmarshalBinary. The primary impact is a denial-of-service (A:H), though it may also lead to security bypasses in URL filtering logic. The issue is fixed in Go versions 1.25.8 and 1.26.1.
Affected products
- Google Go before 1.25.8, 1.26.0-0 before 1.26.1
Timeline
- 2026-02-12: disclosed: Issue opened on Go GitHub repository
- 2026-03-06: advisory: NVD and Go vulnerability report published
- 2026-04-23: patched: Red Hat released security advisories for affected products