CVE-2026-25679
Golang Go ≤ 1.25.8
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-25679 is a high-severity Forced Browsing (CWE-425) vulnerability in Golang Go. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25679 affects the Go programming language's net/url package, specifically the url.Parse function, which insufficiently validates the host/authority component and accepts some invalid URLs. Published on 2026-03-06, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-425.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation results in high-impact denial of service, as indicated by the availability metric.
Mitigation details are provided in official Go advisories and resources, including the vulnerability entry at https://pkg.go.dev/vuln/GO-2026-4601, the announcement at https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk, the issue tracker at https://go.dev/issue/77578, and the code review change at https://go.dev/cl/752180.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10084
Vulnerability Data
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.1V1.4.2V2.1.1V2.2.2
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of authorizations for access to resources such as URLs, scripts, and files, structurally preventing forced browsing.
AC-24 requires that access-control decisions be applied to every request, addressing the missing enforcement on restricted URLs.
SI-10 requires validation of information inputs for correctness, directly stopping syntactic validation failures from being introduced or exploitable.
AC-6 requires restricting authorizations to the minimum needed, reducing the set of resources that must be protected against direct requests.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly requires policy-driven definition, enforcement, and review of authorizations on resources such as URLs.
Protects environments from unauthorized logical access, which includes preventing direct requests to restricted paths.
Secure SDLC practices directly require syntactic input validation to prevent malformed data handling.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect forced-browsing flaws, but the control itself does not prevent them in production.
Information access restriction implements the technical enforcement that directly blocks unauthorized direct requests.
Access control policy directly requires authorization checks on all resources, preventing forced browsing.
Managing access rights ensures every URL/script/file is explicitly authorized, mitigating direct request attacks.
Privileged access rights control enforces least-privilege checks on restricted endpoints.
Secure SDLC can include authorization design, yet the control itself does not guarantee runtime enforcement.