CVE-2025-0938
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
URL parser allowed square brackets in domain names
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
CPython
- Vendor
- Python Software Foundation
- Product
- CPython
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | python | 3.9.22 | Unavailable | None listed |
| 3.10.0 | affected | python | 3.10.17 | Unavailable | None listed |
| 3.11.0 | affected | python | 3.11.12 | Unavailable | None listed |
| 3.12.0 | affected | python | 3.12.9 | Unavailable | None listed |
| 3.13.0 | affected | python | 3.13.2 | Unavailable | None listed |
| 3.14.0a1 | affected | python | 3.14.0a5 | Unavailable | None listed |