The vulnerability CVE-2026-25679 in the Go standard library net/url package arises from improper validation of the syntactic correctness of the host/authority component in URLs parsed by url.Parse. This insufficient validation allows some invalid URLs, including incorrect parsing of IPv6 host literals, to be accepted. The issue has been observed in Red Hat Ansible Automation Platform 2.6 and related components, where it can lead to denial of service impacts. Red Hat has released security advisories and patches to remediate this vulnerability.

The vulnerability does not impact confidentiality or integrity but has an availability impact, potentially causing denial of service. The CVSS v3.1 base score is 7.5 (high), with network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope. This indicates that an unauthenticated attacker can remotely cause denial of service by exploiting the improper URL parsing.

Red Hat has issued official security advisories and patches for affected products, including Red Hat Ansible Automation Platform 2.6 and related components. Users should apply the available updates as detailed in the Red Hat advisories (e.g., RHSA-2026:13508) to remediate this vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigation actions beyond applying the vendor-provided updates are indicated.