vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-0938

URL parser allowed square brackets in domain names

MEDIUM
6.3
CVSS Score
Published: January 31, 2025 at 05:51 PM UTC
Updated: July 31, 2026 at 02:16 PM UTC
1 product affected across 1 vendorPython

Using CPython by Python Software Foundation?

Get instant alerts when new vulnerabilities affect CPython - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.3
Exploit prediction
EPSS 2%
SSVC
No known exploit

Description

The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Python· Python
60%
v < 3.9.223.10.0 ≤ v < 3.10.173.11.0 ≤ v < 3.11.123.12.0 ≤ v < 3.12.93.13.0 ≤ v < 3.13.23.14.0a1 ≤ v < 3.14.0a53.10.03.11.03.12.03.13.03.14.0a1
Affected range stops below 3.10.17, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.11.12, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.12.9, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.13.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.14.0a5, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.9.22, so it looks safe — our inference, not a vendor statement

References (11)

Patch
Source: [email protected]
https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba
Patch
Source: [email protected]
https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403
Patch
Source: [email protected]
https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568
Patch
Source: [email protected]
https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab
Patch
Source: [email protected]
https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a
Patch
Source: [email protected]
https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32
Issue Tracking
Source: [email protected]
https://github.com/python/cpython/issues/105704
Patch
Source: [email protected]
https://github.com/python/cpython/pull/129418

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.3MEDIUMPSF
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-20

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card