Medium severity · published Jan 31, 2025
CVE-2025-0938
URL parser allowed square brackets in domain names
6.3
CVSS
1.6%
EPSS
No
On KEV
Description
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.9.22; 3.10.0 before 3.10.17; 3.11.0 before 3.11.12; 3.12.0 before 3.12.9; 3.13.0 before 3.13.2; 3.14.0a1 before 3.14.0a5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0938
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0938
github.com
https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba
github.com
https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403
github.com
https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568
github.com
https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab
github.com
https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a
github.com
https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.4
CVE-2025-4517
Arbitrary writes via tarfile realpath overflow
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.7
CVE-2024-8088
Infinite loop when iterating over zip archive entry names from zipfile.Path