CVE-2025-47912

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/709857	Patch
https://go.dev/issue/75678	Issue Tracking
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI	Mailing List Release Notes
https://pkg.go.dev/vuln/GO-2025-4010	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/10/08/1	Mailing List Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) La función Parse permite que se incluyan valores distintos de direcciones IPv6 entre corchetes dentro del componente de host de una URL. RFC 3986 permite que las direcciones IPv6 se incluyan dentro del componente de host, encerradas entre corchetes. Por ejemplo: 'http://[::1]/'. Las direcciones IPv4 y los nombres de host no deben aparecer entre corchetes. Parse no aplicó este requisito.

Information

Published : 2025-10-29 23:16

Updated : 2026-10-08 10:10

NVD link : CVE-2025-47912

Mitre link : CVE-2025-47912

CVE.ORG link : CVE-2025-47912

JSON object : View

Products Affected

golang

go

CWE

NVD-CWE-noinfo

{"id": "CVE-2025-47912", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-47912", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T20:37:56.865966Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "Go standard library", "product": "net/url", "versions": [{"status": "affected", "version": "0", "lessThan": "1.24.8", "versionType": "semver"}, {"status": "affected", "version": "1.25.0", "lessThan": "1.25.2", "versionType": "semver"}], "packageName": "net/url", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "parseHost"}, {"name": "JoinPath"}, {"name": "Parse"}, {"name": "ParseRequestURI"}, {"name": "URL.Parse"}, {"name": "URL.UnmarshalBinary"}]}]}], "published": "2025-10-29T23:16:18.187", "references": [{"url": "https://go.dev/cl/709857", "tags": ["Patch"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/75678", "tags": ["Issue Tracking"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI", "tags": ["Mailing List", "Release Notes"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4010", "tags": ["Vendor Advisory"], "source": "security@golang.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/08/1", "tags": ["Mailing List", "Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."}, {"lang": "es", "value": "La funci\u00f3n Parse permite que se incluyan valores distintos de direcciones IPv6 entre corchetes dentro del componente de host de una URL. RFC 3986 permite que las direcciones IPv6 se incluyan dentro del componente de host, encerradas entre corchetes. Por ejemplo: 'http://[::1]/'. Las direcciones IPv4 y los nombres de host no deben aparecer entre corchetes. Parse no aplic\u00f3 este requisito."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1AB9501-4F7D-4E37-BA0A-4E57B082530C", "versionEndExcluding": "1.24.8"}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C196D175-EF20-476C-8C64-1B9F5C50AA2D", "versionEndExcluding": "1.25.2", "versionStartIncluding": "1.25.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@golang.org"}