CVE-2026-25679
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
CVSS
7.5
High
EPSS
0.7%
p50
KEV
—
Exploit Today
15
0-100
Published: Mar 6, 2026 · Last modified: Jul 16, 2026 · CWE-425 · CWE-1286
0.5%EPSS · 30 days0.7%
2026-06-302026-07-16
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
- go.devhttps://go.dev/cl/752180
- go.devhttps://go.dev/issue/77578
- groups.google.comhttps://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
- pkg.go.devhttps://pkg.go.dev/vuln/GO-2026-4601
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10065
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10125
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10133
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10140
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10141
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10158
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10169
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10175
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10184
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10225
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10250
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10701
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10712
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10929
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:11217
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:11375
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-350298.8 HIG97.8%
——29LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.2dCVE-2025-138787.5 HIG94.2%
——28Malformed BRID/HHIT records can cause `named` to terminate unexpectedly.
This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.2dCVE-2026-425797.5 HIG57.9%
——17Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.2dCVE-2026-73077.5 HIG50.6%
——15A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.2dCVE-2026-332187.5 HIG45.5%
——14NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.2dCVE-2026-480597.5 HIG45.0%
——14Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.2d