Description
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.
References (9)
Core 9
Core References
Vendor Advisory
https://security.netapp.com/advisory/ntap-20250411-0004/
Issue Tracking patch
https://github.com/python/cpython/pull/103849
Issue Tracking issue-tracking
https://github.com/python/cpython/issues/103848
Various Sources vendor-advisory
https://mail.python.org/archives/list/[email protected]/thread/XPWB6XVZ5G5KGEI63M4AWLIEUF5BPH4T/
Scores
CVSS v3
3.7
EPSS
0.0055
EPSS Percentile
68.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-918
Status
published
Products (4)
Python Software Foundation/CPython
< 3.9.21
Python Software Foundation/CPython
3.10.0 - 3.10.16
Python Software Foundation/CPython
3.11.0 - 3.11.4
Python Software Foundation/CPython
3.12.0a1 - 3.12.0b1
Published
Nov 12, 2024
Tracked Since
Feb 18, 2026