Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
URL parser may accept malformed IPv6 addresses
published 6 months ago
Summary
A function that reads web addresses does not fully check IPv6 host parts, so it can treat some incorrect URLs as valid. This could cause applications to misroute traffic or expose them to unexpected input. Update the software to a version that fixes the parsing logic or apply the vendor's recommended patch.
What to do
- Update redhat rhc to version 1:0.2.4-7.el9_4.
- Update redhat rhc-debuginfo to version 1:0.2.4-7.el9_4.
- Update redhat rhc-debugsource to version 1:0.2.4-7.el9_4.
- Update redhat rhc-devel to version 1:0.2.4-7.el9_4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_eus:9.4::appstream | redhat | rhc |
< 1:0.2.4-7.el9_4 Fix: upgrade to 1:0.2.4-7.el9_4
|
| Red Hat:rhel_eus:9.4::appstream | redhat | rhc-debuginfo |
< 1:0.2.4-7.el9_4 Fix: upgrade to 1:0.2.4-7.el9_4
|
| Red Hat:rhel_eus:9.4::appstream | redhat | rhc-debugsource |
< 1:0.2.4-7.el9_4 Fix: upgrade to 1:0.2.4-7.el9_4
|
| Red Hat:rhel_eus:9.4::appstream | redhat | rhc-devel |
< 1:0.2.4-7.el9_4 Fix: upgrade to 1:0.2.4-7.el9_4
|
| Red Hat:rhel_eus:9.4::crb | redhat | rhc |
< 1:0.2.4-7.el9_4 Fix: upgrade to 1:0.2.4-7.el9_4
|
| Red Hat:rhel_eus:9.4::crb | redhat | rhc-debuginfo |
< 1:0.2.4-7.el9_4 Fix: upgrade to 1:0.2.4-7.el9_4
|
| Red Hat:rhel_eus:9.4::crb | redhat | rhc-debugsource |
< 1:0.2.4-7.el9_4 Fix: upgrade to 1:0.2.4-7.el9_4
|
| Red Hat:rhel_eus:9.4::crb | redhat | rhc-devel |
< 1:0.2.4-7.el9_4 Fix: upgrade to 1:0.2.4-7.el9_4
|
Original advisory text
Red Hat Security Advisory: rhc security update
References
- https://access.redhat.com/errata/RHSA-2026:8324 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445356 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8324.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-25679 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25679 Vendor Advisory
- https://go.dev/cl/752180 Third Party Advisory
- https://go.dev/issue/77578 Third Party Advisory
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk Third Party Advisory
- https://pkg.go.dev/vuln/GO-2026-4601 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published16 Apr 2026
Updated27 Apr 2026
First seen27 Apr 2026
Sources
RHSA-2026:8324 · OSV
Track software like this
Free during beta