Cyber Resilience

CVE-2026-25679

High

Published: 06 March 2026

Published
06 March 2026
Modified
21 April 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0004 14.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25679 is a high-severity Forced Browsing (CWE-425) vulnerability in Golang Go. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 14.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-25679 affects the Go programming language's net/url package, specifically the url.Parse function, which insufficiently validates the host/authority component and accepts some invalid URLs. Published on 2026-03-06, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-425.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation results in high-impact denial of service, as indicated by the availability metric.

Mitigation details are provided in official Go advisories and resources, including the vulnerability entry at https://pkg.go.dev/vuln/GO-2026-4601, the announcement at https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk, the issue tracker at https://go.dev/issue/77578, and the code review change at https://go.dev/cl/752180.

EU & UK References

Vulnerability details

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

The CVE describes a remotely exploitable flaw in Go's url.Parse that directly results in application or system crash/resource exhaustion (A:H impact, no C/I), mapping to T1499.004 Application or System Exploitation for DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-32281Same product: Golang Go
CVE-2026-27137Same product: Golang Go
CVE-2026-32283Same product: Golang Go
CVE-2026-32280Same product: Golang Go
CVE-2025-61726Same product: Golang Go
CVE-2026-27144Same product: Golang Go
CVE-2025-61732Same product: Golang Go
CVE-2025-61731Same product: Golang Go
CVE-2026-27143Same product: Golang Go
CVE-2026-27140Same product: Golang Go

Affected Assets

golang
go
1.26.0 · ≤ 1.25.8

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Flaw remediation directly mitigates CVE-2026-25679 by applying official Go patches to fix the insufficient URL host/authority validation causing DoS.

prevent

Denial-of-service protection implements mechanisms to block or limit the impact of remote exploitation via malformed URLs leading to high availability disruption.

prevent

Information input validation at the application level rejects or sanitizes invalid URLs before passing to Go's url.Parse, reducing exposure to the parsing flaw.

References