The vulnerability identified as CVE-2026-25679 affects the Go standard library function net/url.Parse, which insufficiently validates the host/authority component of URLs, particularly IPv6 host literals. This results in acceptance of some invalid URLs by ignoring extraneous data before an IP-literal, which should have been rejected. Red Hat's advisory indicates this affects components within Red Hat OpenShift Service Mesh 3.0.10, including istio-rhel9-operator, istio-cni-rhel9, istio-pilot-rhel9, and istio-proxyv2-rhel9. The impact is primarily on availability, with no confidentiality or integrity impact. Red Hat has released updates to address this vulnerability. Mitigations are limited, and the recommended action is to upgrade to the fixed version. The CVSS v3 base score assigned by Red Hat is 7.5 (high severity).

The vulnerability allows malformed IPv6 host literals to be parsed incorrectly, which can lead to denial of service conditions impacting availability. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported. The issue affects network-facing components, increasing the risk of remote exploitation without authentication.

Red Hat has released a fixed version in Red Hat OpenShift Service Mesh 3.0.10. Users should upgrade to this version to remediate the vulnerability. No effective mitigations other than applying the official update are available or meet Red Hat's criteria for ease of use and applicability. Customers are advised to consult Red Hat's advisory and documentation for upgrade instructions.