Requesting patch for CVE-2026-25679 #1980

Open

opened

The CVE is in the Go runtime (net/url.Parse insufficient host validation). The latest version of Kong deck v1.57.0 was built with Go 1.25.7. The fix requires Go 1.25.8+

Metadata

Assignees

No one assigned

Labels

No labels

No labels

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests