CVE-2025-0938

What it actually does

The Python urllib.parse.urlsplit and urlparse functions accept domain names containing square brackets, violating RFC 3986 where brackets are reserved exclusively for IPv6 and IPvFuture address delimiters, enabling inconsistent URL interpretation between Python and compliant parsers.

Why it matters to the business

Applications relying on Python URL parsing may experience bypasses of security controls such as allow-lists, redirects, or host validation when interacting with other systems, increasing risk of unintended behavior in web services and proxies that process external URLs.

How an attack unfolds

An attacker supplies a crafted URL embedding square brackets in the authority component to a Python application; urlparse accepts and returns a parsed result with an unexpected host value while standards-compliant parsers in downstream services or filters treat the input differently, enabling differential parsing attacks such as filter evasion or redirect manipulation.

How to fix it

Upgrade python/cpython to the commit 526617ed68cde460236c973e5d0a8bad4de896ba or later releases that enforce RFC 3986 bracket rules in urlsplit and urlparse; validate all URL inputs against a strict parser before processing.

How to confirm the fix worked

Test urlsplit and urlparse against inputs such as 'http://[example.com]/' and confirm they now raise errors or normalize correctly per RFC 3986; review application code for direct use of these functions on untrusted data.

Typical attack path

1. Craft URL containing square brackets around a non-IPv6 hostname segment
2. Submit URL to Python code path invoking urlsplit or urlparse
3. Receive parsed structure with host value accepted by Python but rejected or altered by other parsers
4. Leverage resulting inconsistency to bypass validation, routing, or security logic in chained components

How to detect it

Search application and proxy logs for URLs containing literal square brackets in the host portion that were successfully parsed; review any recorded host values or redirect targets that include bracketed segments.

What your security team should do

• Prioritize upgrade of all Python environments to the fixed commit in cpython
• Audit codebases for reliance on urlsplit/urlparse results for security decisions
• Implement input sanitization or alternative RFC-compliant URL libraries as defense-in-depth
• Monitor for any downstream dependents affected by the widespread Python standard library usage