CVE-2026-25679
HIGHGo standard library net/url < 1.25.8 and 1.26.0 - Direct Request via Invalid URL Host Parsing
Title source: llmDescription
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
References (4)
Core 4
Core References
Various Sources
https://pkg.go.dev/vuln/GO-2026-4601
Various Sources
https://go.dev/cl/752180
Issue Tracking
https://go.dev/issue/77578
Scores
CVSS v3
7.5
EPSS
0.0052
EPSS Percentile
39.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-425
Status
published
Products (4)
Go standard library/net/url
< 1.25.8
Go standard library/net/url
1.26.0-0 - 1.26.1
golang/go
1.26.0
golang/go
< 1.25.8
Published
Mar 06, 2026
Tracked Since
Mar 07, 2026