The Go standard library’s net/url package fails to fully validate the host or authority component of URLs, accepting certain malformed IPv6 host literals. This weakness corresponds to CWE-1286 (Improper Validation of Input) and CWE-425 (Host/Authority Parsing Weakness). The insufficient validation means that applications using url.Parse can receive and process URLs that are technically invalid, potentially leading to incorrect logic, unintended behavior, or insecure handling of input data.

The vulnerability affects the Go standard library’s net/url package across all Go releases that have not yet incorporated the fix referenced in issue 77578. Applications built with Go that rely on the default url.Parse function are subject to this oversight.

With a CVSS score of 7.5, this issue is classified as high severity. The EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker supplying a crafted URL containing an invalid IPv6 host literal to a Go application that uses net/url.Parse, which may cause the application to treat the malformed URL as valid and lead to unintended behavior or security bypass.