This advisory addresses two security issues in Red Hat Lightspeed for Runtimes on RHEL 9. CVE-2026-25679 concerns the Go standard library function net/url.Parse, which insufficiently validates the host/authority component and incorrectly accepts some invalid IPv6 host literals by ignoring garbage before the IP-literal. This improper validation can lead to incorrect URL parsing. CVE-2026-27137 involves incorrect enforcement of email constraints in the crypto/x509 package. Red Hat has released an update to fix these issues and rates the security impact as important. The advisory references Red Hat's errata and provides links to updated container images. No CVSS score is provided by Red Hat, but the impact is assessed as high for CVE-2026-25679 due to availability impact. Mitigation options for CVE-2026-25679 are currently not available or do not meet Red Hat's standards. Users should apply the update following Red Hat's guidance.

The vulnerabilities affect the parsing and validation logic in critical libraries used by Red Hat Lightspeed for Runtimes, potentially causing incorrect handling of URLs and email constraints. CVE-2026-25679 has a high impact on availability due to improper URL parsing, which could affect applications relying on this library. CVE-2026-27137 affects enforcement of email constraints, which may impact security validation processes. No known exploits in the wild have been reported. The overall security impact is rated as important/high by Red Hat.

Red Hat has released an update for Red Hat Lightspeed for Runtimes on RHEL 9 that addresses these vulnerabilities. Users should ensure all previously released errata are applied before updating. For CVE-2026-25679, no effective mitigation other than applying the update is currently available or meets Red Hat's criteria. Therefore, applying the official update is the recommended remediation. Refer to Red Hat's advisory RHSA-2026:9052 and the article https://access.redhat.com/articles/11258 for detailed update instructions.