Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2025-47912 The Parse function permits values other than IPv6 addresses to be included in square brackets within the host…

Description

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.

Produits et versions touchés

Produit Versions touchées Corrigé en
net/url 1.25 1.25.0 → < 1.25.2 1.25.2
net/url 1.24 premières → < 1.24.8 1.24.8

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de net/url

Les 5 CVE de net/url →
CVE-2026-56860 Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer… 5.9 Moyenne CVE-2026-25679 url.Parse insufficiently validated the host/authority component and accepted some invalid URLs 7.5 Élevée CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query 7.5 Élevée CVE-2022-32190 JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path Non notée
Suivre cette CVE