The Go standard library function net/url.Parse does not properly validate the syntactic correctness of the host/authority component in URLs. Specifically, it treats garbage characters before an IP-literal as ignorable, which should cause the URL to be rejected as invalid. This flaw is classified under CWE-1286 (Improper Validation of Syntactic Correctness of Input). The vulnerability has a CVSS v3.1 base score of 7.5 (high severity) with an impact primarily on availability (denial of service). Red Hat's advisory indicates that no suitable mitigation or fix currently meets their criteria for deployment in affected products, though updates addressing this issue have been released for Red Hat Ansible Automation Platform 2.6. There are no known exploits in the wild at this time.

The vulnerability allows malformed URLs with invalid host/authority components to be accepted by the net/url.Parse function, potentially leading to denial of service conditions. There is no impact on confidentiality or integrity. The CVSS score reflects a high impact on availability. No active exploitation has been reported.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, applicability, or stability. Users should monitor vendor advisories for updates. For Red Hat Ansible Automation Platform 2.6, an update addressing this vulnerability is available and should be applied according to vendor guidance. For other affected Go environments, check the official Go project advisories and apply patches when released.