URL parser allowed square brackets in domain names
Priority LOW 31CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 10 fixed, 3 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01545 75th percentileScored 2026-11-07
Fix Partial CPython (Python Software Foundation): 3.9.22, 3.10.17, 3.11.12 +3Red Hat: 6 advisoriesRed Hat: 10 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Python Software Foundation | CPython | before 3.9.22; 3.10.0 to before 3.10.17; 3.11.0 to before 3.11.12; 3.12.0 to before 3.12.9; 3.13.0 to before 3.13.2; 3.14.0a1 to before 3.14.0a5 | 3.9.22, 3.10.17, 3.11.12, 3.12.9, 3.13.2, 3.14.0a5 | Patch available | CNA |
- CPython VendorPython Software Foundation Affected before 3.9.22; 3.10.0 to before 3.10.17; 3.11.0 to before 3.11.12; 3.12.0 to before 3.12.9; 3.13.0 to before 3.13.2; 3.14.0a1 to before 3.14.0a5 Fixed in 3.9.22, 3.10.17, 3.11.12, 3.12.9, 3.13.2, 3.14.0a5 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | — | — | python-pillow |
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions — — ·python-pillow
Remediation
- Fix · CNA CPython (Python Software Foundation) Fixed in 3.9.22, 3.10.17, 3.11.12, 3.12.9, 3.13.2, 3.14.0a5
Red Hat 6 advisories
- RHSA-2026:5588 Released 2026-03-24 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-74.el8_10, platform-python-debug-3.6.8-74.el8_10, platform-python-devel-3.6.8-74.el8_10 +3
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-74.el8_10, python3-3.6.8-74.el8_10, python3-libs-3.6.8-74.el8_10 +1
- RHSA-2025:23530 Released 2025-12-18 · Red Hat rating Importantpython39:3.9 security update
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.9.0+19644+d68f775d.src::python39:3.9, mod_wsgi-4.7.1-7.module+el8.10.0+23075+0aa18782.1.src::python39:3.9, numpy-1.19.4-3.module+el8.9.0+19644+d68f775d.src::python39:3.9 +47
- Red Hat Enterprise Linux CRB (v. 8) Cython-0.29.21-5.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pybind11-2.7.1-1.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9 +33
- RHSA-2025:8385 Released 2025-06-02 · Red Hat rating ModerateA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 1.14 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
Show 3 more Red Hat advisories
- RHSA-2025:7107 Released 2025-05-13 · Red Hat rating Moderatepython3.12 security update
- Red Hat Enterprise Linux AppStream (v. 9) python3.12-3.12.9-1.el9, python3.12-devel-3.12.9-1.el9, python3.12-libs-3.12.9-1.el9 +1
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.12-3.12.9-1.el9, python3.12-debug-3.12.9-1.el9, python3.12-idle-3.12.9-1.el9 +2
- RHSA-2025:6977 Released 2025-05-13 · Red Hat rating Moderatepython3.9 security update
- Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.21-2.el9, python3-devel-3.9.21-2.el9, python3-tkinter-3.9.21-2.el9
- Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.21-2.el9, python3-libs-3.9.21-2.el9, python3.9-3.9.21-2.el9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3-3.9.21-2.el9, python3-debug-3.9.21-2.el9, python3-idle-3.9.21-2.el9 +2
- RHSA-2025:7109 Released 2025-05-13 · Red Hat rating Moderatepython3.11 security update
- Red Hat Enterprise Linux AppStream (v. 9) python3.11-3.11.11-2.el9, python3.11-devel-3.11.11-2.el9, python3.11-libs-3.11.11-2.el9 +1
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.11-3.11.11-2.el9, python3.11-debug-3.11.11-2.el9, python3.11-idle-3.11.11-2.el9 +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Discovery 1.14 | Fixed | RHSA-2025:8385 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:23530, RHSA-2026:5588 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:6977, RHSA-2025:7107, RHSA-2025:7109 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | — |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:5588 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2025:6977 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2025:23530 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | — |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2025:6977, RHSA-2025:7107, RHSA-2025:7109 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-0938
- 2026-10-03 Alias added: GHSA-5qjr-cj9f-phrx
References
Patch 7
- https://github.com/python/cpython/pull/129418
- https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a
- https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403
- https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568
- https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba
- https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab
- https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32
Advisory 1
More Python Software Foundation vulnerabilities
- TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
- TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
- TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
- TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
- TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
- TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
Sources
- CVE-2025-0938 · CVE Program
- CVE-2025-0938 · NVD
- FIRST EPSS
- GHSA-5qjr-cj9f-phrx · GitHub Advisory Database · CC BY 4.0
- CVE-2025-0938 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences