Skip to content
fr Sign in
5.3 Medium

CVE-2025-47912 The Parse function permits values other than IPv6 addresses to be included in square brackets within the host…

Description

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.

Affected products and versions

Product Affected versions Fixed in
net/url 1.25 1.25.0 → < 1.25.2 1.25.2
net/url 1.24 earliest → < 1.24.8 1.24.8

References

Timeline

  1. Published
  2. Last modified

Other CVEs of net/url

The 5 CVEs of net/url →
CVE-2026-56860 Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer… 5.9 Medium CVE-2026-25679 url.Parse insufficiently validated the host/authority component and accepted some invalid URLs 7.5 High CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query 7.5 High CVE-2022-32190 JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path Not rated
Track this CVE