CVE-2025-47912

MEDIUM5.3

Insufficient validation of bracketed IPv6 hostnames in net/url

Published Oct 29, 2025

Modified 2 months ago

No fix available

Details

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.

References

WEBhttp://www.openwall.com/lists/oss-security/2025/10/08/1 WEBhttps://go.dev/cl/709857 WEBhttps://go.dev/issue/75678 WEBhttps://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI WEBhttps://pkg.go.dev/vuln/GO-2025-4010 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-47912

CVSS Analysis

CVSS v3.1

5.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

NoneA:N

5.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Ecosystems

Timeline

PublishedOct 29, 2025

ModifiedNov 4, 2025