This vulnerability (CVE-2026-25679, CVSS 7.5 HIGH) in the `net/url` Go library involves incorrect parsing of IPv6 host literals, which could be exploited to manipulate URL handling. The underlying Go language versions affected are `go < 1.25.8` and `go version 1.26.0`. The fix is incorporated in the updated `yggdrasil-worker-package-manager-0.2.3-5.el10_1` package for Red Hat Enterprise Linux 10.
Red Hat Product Errata RHSA-2026:11412 - Security Advisory Issued: 2026-04-28 Updated: 2026-04-28 RHSA-2026:11412 - Security Advisory Overview Updated Packages Synopsis Important: yggdrasil-worker-package-manager security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for yggdrasil-worker-package-manager is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Fixes BZ - 2445356 - CVE-2026-25679 net/url: Incorrect parsing of IPv6 host literals in net/url CVEs CVE-2026-25679 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM yggdrasil-worker-package-manager-0.2.3-5.el10_1.src.rpm SHA-256: 6846cc36fb4719578550a55f214a42b2bb529e5e5195b28bb6fa1941f73ebad4 x86_64 yggdrasil-worker-package-manager-0.2.3-5.el10_1.x86_64.rpm SHA-256: 809bfe9765094c0a3d6f076c5dd24c4eb8e86621b8052e40ab114bde5b25407a yggdrasil-worker-package-manager-debuginfo-0.2.3-5.el10_1.x86_64.rpm SHA-256: 9ebf4bc1c6b3d9e22f59915054073426a8054a7db088b41f02c2cfc3d851a3ce yggdrasil-worker-package-manager-debugsource-0.2.3-5.el10_1.x86_64.rpm SHA-256: 9ac1bc855e17f9f775e74e647ddf12fe81591645a72d9ed67fcaff4050f266ea Red Hat Enterprise Linux for IBM z Systems 10 SRPM yggdrasil-worker-package-manager-0.2.3-5.el10_1.src.rpm SHA-256: 6846cc36fb4719578550a55f214a42b2bb529e5e5195b28bb6fa1941f73ebad4 s390x yggdrasil-worker-package-manager-0.2.3-5.el10_1.s390x.rpm SHA-256: dab33f7615188d6520008df2b633ab585b1c7630dfd4ce9624cf8999d71905ab yggdrasil-worker-package-manager-debuginfo-0.2.3-5.el10_1.s390x.rpm SHA-256: 8d2f154e83d300db588acab68987eb1a21f216097b171f4bc231b18ee403abd3 yggdrasil-worker-package-manager-debugsource-0.2.3-5.el10_1.s390x.rpm SHA-256: c464198791b661c2b8a1d0b185a8d993efe42e5de5ee0d6c6f77b665764e151b Red Hat Enterprise Linux for Power, little endian 10 SRPM yggdrasil-worker-package-manager-0.2.3-5.el10_1.src.rpm SHA-256: 6846cc36fb4719578550a55f214a42b2bb529e5e5195b28bb6fa1941f73ebad4 ppc64le yggdrasil-worker-package-manager-0.2.3-5.el10_1.ppc64le.rpm SHA-256: 4fa309aa16124ff7cce6e87ef6bd467ea6857f716be7bae22e6b7d8ca3867def yggdrasil-worker-package-manager-debuginfo-0.2.3-5.el10_1.ppc64le.rpm SHA-256: dca2ee58b13ac39a2dac5a04c15948774b216b38be54b3ce4c479b6fd6f6a8c0 yggdrasil-worker-package-manager-debugsource-0.2.3-5.el10_1.ppc64le.rpm SHA-256: 397c0ba68c8d3aee4d20e1edee7ab97d66ce81c89b1bbddac8d7e80538a0390d Red Hat Enterprise Linux for ARM 64 10 SRPM yggdrasil-worker-package-manager-0.2.3-5.el10_1.src.rpm SHA-256: 6846cc36fb4719578550a55f214a42b2bb529e5e5195b28bb6fa1941f73ebad4 aarch64 yggdrasil-worker-package-manager-0.2.3-5.el10_1.aarch64.rpm SHA-256: 98d71e176d9fde303255533324fb23a47fec3c07383af6aef7e804f797da8733 yggdrasil-worker-package-manager-debuginfo-0.2.3-5.el10_1.aarch64.rpm SHA-256: 4d0a3ca8a28f2ba0106477d7a92a01685ac743c40ec7e97c642c8e1649dd2aa6 yggdrasil-worker-package-manager-debugsource-0.2.3-5.el10_1.aarch64.rpm SHA-256: 3fa8f873643b46fed6da04ed850dbf14cd78be3043530810c48f84b25dcfb2a1 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .