rhsa-2026:9695 — Insufficient host validation in Go net/url.Parse

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP literal as ignorable.