CVE-2026-25679

HIGH

7.5

CVSS v3

NVD

Description

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CWE-425 CWE-1286

How to fix

Remediation Available

aardvark-dns-2:1.0.1Rocky

Fixed in:40.module+el8.6.0+24209+25a14987.s390x::container-tools:rhel8RHSA-2026:19634

Fixed in:40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8RHSA-2026:51288

Fixed in:40.module+el8.6.0+24209+25a14987.aarch64::container-tools:rhel8RHSA-2026:19634

Fixed in:40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8RHSA-2026:19634

Fixed in:40.module+el8.6.0+24209+25a14987.ppc64le::container-tools:rhel8RHSA-2026:19634

aardvark-dns-2:1.0.1Red Hat / RHEL

Fixed in:40.module+el8.6.0+24209+25a14987.s390x::container-tools:rhel8RHSA-2026:19634

Fixed in:40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8RHSA-2026:19634

Fixed in:40.module+el8.6.0+24209+25a14987.ppc64le::container-tools:rhel8RHSA-2026:19634

Fixed in:40.module+el8.6.0+24209+25a14987.aarch64::container-tools:rhel8RHSA-2026:19634

Fixed in:40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8RHSA-2026:51288

aardvark-dns-2:1.10.1Red Hat / RHEL

Fixed in:2.module+el8.10.0+24321+617e8352.x86_64::container-tools:rhel8RHSA-2026:33722

Fixed in:2.module+el8.10.0+24321+617e8352.src::container-tools:rhel8RHSA-2026:33722

Fixed in:2.module+el8.10.0+24321+617e8352.ppc64le::container-tools:rhel8RHSA-2026:33722

Fixed in:2.module+el8.10.0+24321+617e8352.s390x::container-tools:rhel8RHSA-2026:33722

Fixed in:2.module+el8.10.0+24321+617e8352.aarch64::container-tools:rhel8RHSA-2026:33722

aardvark-dns-2:1.10.1Rocky

Fixed in:2.module+el8.10.0+24321+617e8352.x86_64::container-tools:rhel8RHSA-2026:33722

Fixed in:2.module+el8.10.0+24321+617e8352.s390x::container-tools:rhel8RHSA-2026:33722

Fixed in:2.module+el8.10.0+24321+617e8352.ppc64le::container-tools:rhel8RHSA-2026:33722

Fixed in:2.module+el8.10.0+24321+617e8352.aarch64::container-tools:rhel8RHSA-2026:33722

Fixed in:2.module+el8.10.0+24321+617e8352.src::container-tools:rhel8RHSA-2026:33722

aardvark-dns-2:1.5.0Rocky

Fixed in:2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8RHSA-2026:49944

Fixed in:2.module+el8.8.0+23884+2031fc78.ppc64le::container-tools:rhel8RHSA-2026:49944

Fixed in:2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8RHSA-2026:49944

aardvark-dns-2:1.5.0Red Hat / RHEL

Fixed in:2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8RHSA-2026:49944

Fixed in:2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8RHSA-2026:49944

Fixed in:2.module+el8.8.0+23884+2031fc78.ppc64le::container-tools:rhel8RHSA-2026:49944

ansible-coreRocky

Fixed in:2:2.16.18-2.el10apRHSA-2026:13508

Fixed in:1:2.16.18-1.el8apRHSA-2026:13512

Fixed in:1:2.16.18-1.el9apRHSA-2026:13508

Fixed in:1:2.16.18-1.el9apRHSA-2026:13512

Fixed in:1:2.16.18-1.el9apRHSA-2026:13508

ansible-coreRed Hat / RHEL

Fixed in:2:2.16.18-2.el10apRHSA-2026:13508

Fixed in:1:2.16.18-1.el8apRHSA-2026:13512

Fixed in:1:2.16.18-1.el9apRHSA-2026:13512

Fixed in:1:2.16.18-1.el9apRHSA-2026:13508

ansible-lintRed Hat / RHEL

Fixed in:0:26.1.1-2.el10apRHSA-2026:13508

Fixed in:0:26.1.1-1.el8apRHSA-2026:13512

Fixed in:0:26.1.1-1.el9apRHSA-2026:13512

Fixed in:0:26.1.1-1.el9apRHSA-2026:13508

ansible-lintRocky

Fixed in:0:26.1.1-2.el10apRHSA-2026:13508

Fixed in:0:26.1.1-1.el8apRHSA-2026:13512

Fixed in:0:26.1.1-1.el9apRHSA-2026:13508

Fixed in:0:26.1.1-1.el9apRHSA-2026:13512

Fixed in:0:26.1.1-1.el9apRHSA-2026:13508

Fixed in:0:26.1.1-1.el9apRHSA-2026:13512

ansible-testRocky

Fixed in:1:2.16.18-1.el8apRHSA-2026:13512

Fixed in:1:2.16.18-1.el9apRHSA-2026:13512

Fixed in:1:2.16.18-1.el9apRHSA-2026:13508

ansible-testRed Hat / RHEL

Fixed in:1:2.16.18-1.el8apRHSA-2026:13512

Fixed in:1:2.16.18-1.el9apRHSA-2026:13512

Fixed in:1:2.16.18-1.el9apRHSA-2026:13508

automation-controllerRed Hat / RHEL

Fixed in:0:4.6.28-3.el8apRHSA-2026:13512

Fixed in:0:4.7.11-2.el9apRHSA-2026:13508

automation-controllerRocky

Fixed in:0:4.6.28-3.el8apRHSA-2026:13512

Fixed in:0:4.6.28-3.el9apRHSA-2026:13512

Fixed in:0:4.7.11-2.el9apRHSA-2026:13508

automation-controller-cliRocky

Fixed in:0:4.6.28-3.el8apRHSA-2026:13512

Fixed in:0:4.7.11-2.el9apRHSA-2026:13508

Fixed in:0:4.6.28-3.el9apRHSA-2026:13512

automation-controller-cliRed Hat / RHEL

Fixed in:0:4.6.28-3.el8apRHSA-2026:13512

Fixed in:0:4.6.28-3.el9apRHSA-2026:13512

Fixed in:0:4.7.11-2.el9apRHSA-2026:13508

automation-controller-serverRocky

Fixed in:0:4.6.28-3.el8apRHSA-2026:13512

Fixed in:0:4.6.28-3.el9apRHSA-2026:13512

Fixed in:0:4.7.11-2.el9apRHSA-2026:13508

automation-controller-serverRed Hat / RHEL

Fixed in:0:4.6.28-3.el8apRHSA-2026:13512

Fixed in:0:4.7.11-2.el9apRHSA-2026:13508

Fixed in:0:4.6.28-3.el9apRHSA-2026:13512

automation-controller-uiRed Hat / RHEL

Fixed in:0:4.6.28-3.el8apRHSA-2026:13512

Fixed in:0:4.7.11-2.el9apRHSA-2026:13508

Fixed in:0:4.6.28-3.el9apRHSA-2026:13512

automation-controller-uiRocky

Fixed in:0:4.6.28-3.el8apRHSA-2026:13512

Fixed in:0:4.7.11-2.el9apRHSA-2026:13508

Fixed in:0:4.6.28-3.el9apRHSA-2026:13512

automation-controller-venv-towerRocky

Fixed in:0:4.6.28-3.el8apRHSA-2026:13512

Fixed in:0:4.7.11-2.el9apRHSA-2026:13508

Fixed in:0:4.6.28-3.el9apRHSA-2026:13512

Fixed in:0:4.7.11-2.el9apRHSA-2026:13508

Fixed in:0:4.6.28-3.el9apRHSA-2026:13512

automation-controller-venv-towerRed Hat / RHEL

Fixed in:0:4.6.28-3.el8apRHSA-2026:13512

Fixed in:0:4.7.11-2.el9apRHSA-2026:13508

automation-eda-controllerRocky

Fixed in:0:1.1.18-1.el8apRHSA-2026:13512

Fixed in:0:1.2.8-1.el9apRHSA-2026:13508

Fixed in:0:1.1.18-1.el9apRHSA-2026:13512

automation-eda-controllerRed Hat / RHEL

Fixed in:0:1.1.18-1.el8apRHSA-2026:13512

Fixed in:0:1.1.18-1.el9apRHSA-2026:13512

Fixed in:0:1.2.8-1.el9apRHSA-2026:13508

Fixed in:0:1.1.18-1.el9apRHSA-2026:13512

Fixed in:0:1.2.8-1.el9apRHSA-2026:13508

automation-eda-controller-baseRed Hat / RHEL

Fixed in:0:1.1.18-1.el8apRHSA-2026:13512

Fixed in:0:1.1.18-1.el9apRHSA-2026:13512

Fixed in:0:1.2.8-1.el9apRHSA-2026:13508

automation-eda-controller-baseRocky

Fixed in:0:1.1.18-1.el8apRHSA-2026:13512

Fixed in:0:1.2.8-1.el9apRHSA-2026:13508

Fixed in:0:1.1.18-1.el9apRHSA-2026:13512

automation-eda-controller-base-servicesRed Hat / RHEL

Fixed in:0:1.1.18-1.el8apRHSA-2026:13512

Fixed in:0:1.2.8-1.el9apRHSA-2026:13508

Fixed in:0:1.1.18-1.el9apRHSA-2026:13512

automation-eda-controller-base-servicesRocky

Fixed in:0:1.1.18-1.el8apRHSA-2026:13512

Fixed in:0:1.2.8-1.el9apRHSA-2026:13508

Fixed in:0:1.1.18-1.el9apRHSA-2026:13512

automation-eda-controller-event-stream-servicesRocky

Fixed in:0:1.1.18-1.el8apRHSA-2026:13512

Fixed in:0:1.2.8-1.el9apRHSA-2026:13508

Fixed in:0:1.1.18-1.el9apRHSA-2026:13512

automation-eda-controller-event-stream-servicesRed Hat / RHEL

Fixed in:0:1.1.18-1.el8apRHSA-2026:13512

Fixed in:0:1.1.18-1.el9apRHSA-2026:13512

Fixed in:0:1.2.8-1.el9apRHSA-2026:13508

This vulnerability affects an unusually large number of packages. The highest-confidence fixes are shown above; the full list is longer. Check the referenced advisories for complete coverage.

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploit Intelligence

0.73%probability of exploitation in 30 days

52ndpercentile

Moderate risk: more likely to be exploited than 52% of all known CVEs.

References

Vendor Advisory1

pkg.go.dev

Issue Tracking1

go.dev

Mailing List1

go.dev

Release Notes1

groups.google.com

Other references46

Related Vulnerabilities

Other CWE-425 vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2024-45195	High	7.5	100%	KEV	Fix
CVE-2021-26085	Medium	5.3	100%	KEV + Ransom	Fix
CVE-2024-0204	Critical	9.8	95%	-	Fix
CVE-2018-19207	Critical	9.8	88%	-	Fix
CVE-2017-17736	Critical	9.8	69%	-	Fix
CVE-2021-40875	High	7.5	48%	-	Fix

Common questions

How do I fix CVE-2026-25679?

Published advisories record a fix for 393 affected products. The "How to fix" section on this page lists the fixed version and source advisory for each one, so apply the entry matching what you actually run.

Is CVE-2026-25679 being actively exploited?

Not that we know of. CVE-2026-25679 is not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS score of 0.73% is the estimated probability that it will be exploited in the next 30 days. That is higher than 52% of all scored CVEs.

How severe is CVE-2026-25679?

CVE-2026-25679 has a CVSS v3 base score of 7.5, rated important. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.

What does CVE-2026-25679 affect?

Published advisories record a fix for aardvark-dns-2:1.0.1 (Rocky), aardvark-dns-2:1.0.1 (Red Hat / RHEL), aardvark-dns-2:1.10.1 (Red Hat / RHEL), aardvark-dns-2:1.10.1 (Rocky), and 389 more. The list on this page is capped, so there may be more.

Embed a live status badge for CVE-2026-25679

Markdown

[![CVE-2026-25679](https://tridentstack.com/cve/badge/CVE-2026-25679.svg)](https://tridentstack.com/cve/CVE-2026-25679)

HTML

<a href="https://tridentstack.com/cve/CVE-2026-25679"><img src="https://tridentstack.com/cve/badge/CVE-2026-25679.svg" alt="CVE-2026-25679"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

See how it works Start freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-08-28.