CVE-2025-0938

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0938", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "state": "PUBLISHED", "assignerShortName": "PSF", "dateReserved": "2025-01-31T17:45:10.107Z", "datePublished": "2025-01-31T17:51:35.898Z", "dateUpdated": "2026-07-31T14:05:21.438Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"version": "0", "lessThan": "3.9.22", "status": "affected", "versionType": "python"}, {"version": "3.10.0", "lessThan": "3.10.17", "status": "affected", "versionType": "python"}, {"version": "3.11.0", "lessThan": "3.11.12", "status": "affected", "versionType": "python"}, {"version": "3.12.0", "lessThan": "3.12.9", "status": "affected", "versionType": "python"}, {"version": "3.13.0", "lessThan": "3.13.2", "status": "affected", "versionType": "python"}, {"version": "3.14.0a1", "lessThan": "3.14.0a5", "status": "affected", "versionType": "python"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.<br>"}], "value": "The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-07-31T14:05:21.438Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://github.com/python/cpython/issues/105704"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/pull/129418"}, {"tags": ["vendor-advisory"], "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32"}], "source": {"discovery": "UNKNOWN"}, "title": "URL parser allowed square brackets in domain names", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-31T18:50:16.654297Z", "id": "CVE-2025-0938", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-31T18:50:29.327Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20250314-0002/"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:56:43.285Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20250314-0002/"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:56:43.285Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0938", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-31T18:50:16.654297Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-31T18:50:24.989Z"}}], "cna": {"title": "URL parser allowed square brackets in domain names", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "product": "CPython", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.22", "versionType": "python"}, {"status": "affected", "version": "3.10.0", "lessThan": "3.10.17", "versionType": "python"}, {"status": "affected", "version": "3.11.0", "lessThan": "3.11.12", "versionType": "python"}, {"status": "affected", "version": "3.12.0", "lessThan": "3.12.9", "versionType": "python"}, {"status": "affected", "version": "3.13.0", "lessThan": "3.13.2", "versionType": "python"}, {"status": "affected", "version": "3.14.0a1", "lessThan": "3.14.0a5", "versionType": "python"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/python/cpython/issues/105704", "tags": ["issue-tracking"]}, {"url": "https://github.com/python/cpython/pull/129418", "tags": ["patch"]}, {"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.", "supportingMedia": [{"type": "text/html", "value": "The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-07-31T14:05:21.438Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0938", "state": "PUBLISHED", "dateUpdated": "2026-07-31T14:05:21.438Z", "dateReserved": "2025-01-31T17:45:10.107Z", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "datePublished": "2025-01-31T17:51:35.898Z", "assignerShortName": "PSF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"lessThan": "3.9.22", "status": "affected", "version": "0", "versionType": "python"}, {"lessThan": "3.10.17", "status": "affected", "version": "3.10.0", "versionType": "python"}, {"lessThan": "3.11.12", "status": "affected", "version": "3.11.0", "versionType": "python"}, {"lessThan": "3.12.9", "status": "affected", "version": "3.12.0", "versionType": "python"}, {"lessThan": "3.13.2", "status": "affected", "version": "3.13.0", "versionType": "python"}, {"lessThan": "3.14.0a5", "status": "affected", "version": "3.14.0a1", "versionType": "python"}]}], "source": "cna@python.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."}, {"lang": "es", "value": "Las funciones est\u00e1ndar librer\u00eda de Python `urllib.parse.urlsplit` y `urlparse` aceptaban nombres de dominio que inclu\u00edan corchetes, lo que no es v\u00e1lido seg\u00fan RFC 3986. Los corchetes solo se deben usar como delimitadores para especificar hosts IPv6 e IPvFuture en las URL. Esto podr\u00eda generar un an\u00e1lisis diferencial entre el analizador de URL de Python y otros analizadores de URL que cumplen con las especificaciones."}], "id": "CVE-2025-0938", "lastModified": "2026-07-31T14:16:42.597", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@python.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0938", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-31T18:50:16.654297Z", "version": "2.0.3"}}]}, "published": "2025-01-31T18:15:38.053", "references": [{"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/issues/105704"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/pull/129418"}, {"source": "cna@python.org", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20250314-0002/"}], "sourceIdentifier": "cna@python.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "cna@python.org", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:6977", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "python3.9-0:3.9.21-2.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:7107", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "python3.12-0:3.12.9-1.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:7109", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "python3.11-0:3.11.11-2.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6977", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "python3.9-0:3.9.21-2.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:8385", "cpe": "cpe:/a:redhat:discovery:1.14::el9", "package": "registry.redhat.io/discovery/discovery-server-rhel9:sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63", "product_name": "Red Hat Discovery 1.14", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:8385", "cpe": "cpe:/a:redhat:discovery:1.14::el9", "package": "registry.redhat.io/discovery/discovery-ui-rhel9:sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644", "product_name": "Red Hat Discovery 1.14", "release_date": "2025-06-02T00:00:00Z"}], "bugzilla": {"description": "python: cpython: URL parser allowed square brackets in domain names", "id": "2343237", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343237"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "status": "verified"}, "cwe": "CWE-20", "details": ["The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.", "A flaw was found in Python. The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accept domain names that included square brackets, which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-0938", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "python3.12", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "python", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "python", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "python3", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "python3", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "python3.11", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "python3.12", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "python36:3.6/python36", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "python39:3.9/python39", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2025-01-31T17:51:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-0938\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-0938\nhttps://github.com/python/cpython/issues/105704\nhttps://github.com/python/cpython/pull/129418"], "statement": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-20: Improper Input Validation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\nRed Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. This minimizes the number of components that could be affected by input validation vulnerabilities. Security testing and evaluation standards are implemented within the environment to rigorously test input validation mechanisms during the development lifecycle, while static code analysis identifies potential input validation vulnerabilities by default. Process isolation ensures that processes handling potentially malicious or unvalidated inputs run in isolated environments by separating execution domains for each process. Malicious code protections, such as IPS/IDS and antimalware solutions, help detect and mitigate malicious payloads stemming from input validation vulnerabilities. Finally, robust input validation and error-handling mechanisms ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks further.", "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-22T12:11:35.795728+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest CPython release that contains the urllib.parse fix", "Validate that host components of URLs do not contain '[' or ']' unless they are part of an IPv6 or IPvFuture literal before calling urllib.parse", "Implement tests to ensure that URL parsing behaves consistently with RFC\u202f3986 when processing user\u2011supplied URLs"], "summary": {"action": "Update CPython", "impact": "Parsing inconsistencies leading to logic errors"}, "threat_synthesis": {"affected_systems": "The defect resides in CPython, the reference implementation of Python produced by the Python Software Foundation. Any deployment of CPython that uses the affected urllib.parse functions\u2014such as applications and services built against older Python releases\u2014may be impacted. Red\u202fHat Enterprise\u202fLinux\u202f9 and related packages that ship Python, as indicated by the supplied CPE identifiers, are therefore also covered.", "description_and_impact": "A flaw in Python\u2019s urllib.parse.urlsplit and urlparse accepts domain names containing square brackets, which are not permitted by RFC\u202f3986 except as delimiters for IPv6 or IPvFuture addresses. This improper input validation causes URLs to be parsed differently by Python than by other compliant parsers, potentially exposing applications to security\u2011sensitive logic errors such as incorrect hostname verification or unauthorized redirects. The CWE\u201120 designation confirms the issue is an input validation flaw.", "risk_and_exploitability": "The CVSS score of 6.3 indicates moderate severity, while the EPSS score of 1\u00a0% suggests a low likelihood of exploitation at the time of assessment and the vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack vector is an attacker who can supply a crafted URL containing square brackets in a domain name to an application that passes it directly to urllib.parse. Because the parsing error creates a mismatch between the hostname seen by Python and that seen by other parsers, a malicious user could potentially bypass hostname checks or redirect logic, facilitating phishing or other logic\u2011bypass attacks. This inference is deduced from the description and the nature of the flaw, as the CVE text does not explicitly describe an exploitation path."}}}}, "created": "2026-04-22T12:15:16.051264+00:00", "updated": "2026-04-22T12:15:16.051275+00:00", "vendors": []}