CVE-2025-0938

Name of the Vulnerable Software and Affected Versions Python versions prior to 3.11.12

Description The Python standard library functions urllib.parse.urlsplit() and urlparse() accepted domain names containing square brackets, which violates RFC 3986. According to the specification, square brackets should only be used as delimiters for IPv6 and IPvFuture hosts in URLs. This inconsistency can lead to differential parsing between the Python URL parser and other parsers that strictly comply with the specification.

Recommendations Update Python to version 3.11.12.