The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Go | Golang | * | 1.24.8 (excluding) |
| Go | Golang | 1.25.0 (including) | 1.25.2 (excluding) |
| Red Hat Hardened Images | RedHat | golang1-26-main-1.26.2-1.hum1 | * |
| Red Hat Hardened Images | RedHat | golang1-25-main-1.25.9-1.hum1 | * |
| Golang-1.10 | Ubuntu | esm-infra/xenial | * |
| Golang-1.13 | Ubuntu | esm-apps/xenial | * |
| Golang-1.18 | Ubuntu | esm-apps/xenial | * |
| Golang-1.23 | Ubuntu | plucky | * |
| Golang-1.24 | Ubuntu | plucky | * |
| Golang-1.6 | Ubuntu | esm-infra/xenial | * |