Vulnerability Details : CVE-2025-0938
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
Products affected by CVE-2025-0938
Please log in to view affected product information.
Exploit prediction scoring system (EPSS) score for CVE-2025-0938
1.02%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 76 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2025-0938
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.3
|
MEDIUM | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/V... |
N/A
|
N/A
|
Python Software Foundation | 2025-01-31 |
|
6.3
|
MEDIUM | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/V... |
N/A
|
N/A
|
Python Software Foundation | 2025-01-31 |
CWE ids for CVE-2025-0938
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by:
- 28c92f92-d60d-412d-b760-e73465c3df22 (Primary)
- cna@python.org (Secondary)
References for CVE-2025-0938
-
https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a
-
https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab
[3.10] gh-105704: Disallow square brackets (`[` and `]`) in domain na… · python/cpython@b8b4b71 · GitHub
-
https://security.netapp.com/advisory/ntap-20250314-0002/
CVE-2025-0938 Python Vulnerability in NetApp Products | NetApp Product Security
-
https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403
-
https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32
-
https://github.com/python/cpython/issues/105704
urlparse does not flag hostname *containing* [ or ] as incorrect · Issue #105704 · python/cpython
-
https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba
-
https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/
-
https://github.com/python/cpython/pull/129418
gh-105704: Disallow square brackets (`[` and `]`) in domain names for parsed URLs by sethmlarson · Pull Request #129418 · python/cpython · GitHub
-
https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568
[3.12] gh-105704: Disallow square brackets (`[` and `]`) in domain na… · python/cpython@a7084f6 · GitHub
Jump to