CVE-2024-11168

What it actually does

The urllib.parse.urlsplit() and urlparse() functions accept bracketed hosts that are neither valid IPv6 nor IPvFuture addresses, violating RFC 3986 and producing inconsistent results when the same URL is later processed by a stricter parser.

Why it matters to the business

Applications that rely on these functions for URL handling may be tricked into issuing requests to unintended internal hosts, creating a pathway for unauthorized data access or internal network probing with minimal attacker effort.

How an attack unfolds

An attacker supplies a crafted URL containing an invalid bracketed host to an application endpoint that uses urlparse; if a second, stricter parser subsequently interprets the host differently, the request is redirected to an attacker-chosen internal target, enabling SSRF.

How to fix it

Upgrade python/cpython to the commit 29f348e232e82938ba2165843c448c2b291504c5 or a later equivalent release that enforces RFC 3986 host validation.

How to confirm the fix worked

Confirm the installed CPython commit or version contains 29f348e232e82938ba2165843c448c2b291504c5; test that urlparse and urlsplit now reject non-IPv6 bracketed hosts per RFC 3986.

Typical attack path

1. Identify an application endpoint that accepts and parses URLs with Python's urlparse or urlsplit
2. Craft a URL containing a non-RFC-conformant bracketed host
3. Submit the URL to the target endpoint
4. Trigger secondary parsing that resolves the host to an internal destination
5. Observe or exfiltrate data from the resulting internal request

How to detect it

Review application logs for URLs containing bracketed host segments that are not valid IPv6 addresses; correlate with outbound connection attempts to internal IP ranges that do not match expected destinations.

What your security team should do

• Apply the fixed CPython commit to all affected runtimes within the next maintenance window
• Audit code paths that pass untrusted URLs through multiple parsers
• Add input validation that rejects bracketed hosts not matching IPv6 or IPvFuture syntax
• Monitor for any increase in EPSS or public exploit code