CVE-2025-0938: URL parser allowed square brackets in domain names
Last updated 24 March 2025
Other sources
The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
URL parser allowed square brackets in domain names
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.19+dfsg-2 - Upgrade
Upgrade
debian/python3.12to a version that resolves this vulnerability.Fixed in 3.12.10-1 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.3-2 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1+deb11u3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0938?
CVE-2025-0938 has been classified as a medium severity vulnerability due to potential denial of service risks associated with invalid URL parsing.
How do I fix CVE-2025-0938?
To fix CVE-2025-0938, update to the latest version of Python where the vulnerability has been addressed.
What software is affected by CVE-2025-0938?
CVE-2025-0938 affects the standard library functions of Python, specifically in the urllib.parse module.
What are the implications of CVE-2025-0938?
The implications of CVE-2025-0938 include the possibility of malformed URLs causing unexpected behavior in applications relying on URL parsing.
How does CVE-2025-0938 impact web applications?
CVE-2025-0938 can potentially lead to security issues in web applications by allowing the processing of invalid domain names.