This advisory addresses two security issues in Red Hat Lightspeed for Runtimes on RHEL 9. The first, CVE-2026-25679, is an incorrect parsing vulnerability in the net/url package related to IPv6 host literals. The second, CVE-2026-27137, concerns improper enforcement of email constraints in the crypto/x509 package. Both issues could potentially affect the security of applications relying on these components. Red Hat has released an update to fix these vulnerabilities and recommends applying it following standard update procedures.

The vulnerabilities could lead to incorrect handling of network URLs and email constraints, potentially impacting security controls that depend on these functions. Red Hat rates the security impact as Important. There are no reports of active exploitation in the wild. The exact impact details and CVSS scores are available on the respective CVE pages referenced by Red Hat.

Red Hat has released an update for Red Hat Lightspeed for Runtimes on RHEL 9 that addresses these vulnerabilities. Users should ensure all previously released errata are applied before installing this update. Detailed update instructions are available at Red Hat's official documentation (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated by the vendor advisory.