CVE-2025-47912 (GCVE-0-2025-47912)

Vulnerability from cvelistv5 – Published: 2025-10-29 22:10 – Updated: 2025-11-04 21:10
VLAI
Title
Insufficient validation of bracketed IPv6 hostnames in net/url
Summary
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-30 20:37 UTC
CWE
  • CWE-1286 - Improper Validation of Syntactic Correctness of Input
Assigner
References
Impacted products
Vendor Product Version CPE status
Go standard library net/url Affected: 0 , < 1.24.8 (semver)
Affected: 1.25.0 , < 1.25.2 (semver)
guessed Create a notification for this product.
Credits
Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua University
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-47912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-30T20:37:56.865966Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-30T20:38:24.266Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:10:57.384Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/08/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/url",
          "product": "net/url",
          "programRoutines": [
            {
              "name": "parseHost"
            },
            {
              "name": "JoinPath"
            },
            {
              "name": "Parse"
            },
            {
              "name": "ParseRequestURI"
            },
            {
              "name": "URL.Parse"
            },
            {
              "name": "URL.UnmarshalBinary"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.24.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.25.2",
              "status": "affected",
              "version": "1.25.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua University"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T22:10:13.435Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/75678"
        },
        {
          "url": "https://go.dev/cl/709857"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-4010"
        }
      ],
      "title": "Insufficient validation of bracketed IPv6 hostnames in net/url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-47912",
    "datePublished": "2025-10-29T22:10:13.435Z",
    "dateReserved": "2025-05-13T23:31:29.597Z",
    "dateUpdated": "2025-11-04T21:10:57.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-47912",
      "date": "2026-10-01",
      "epss": "0.00468",
      "percentile": "0.3817"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:50:03.000Z",
      "cve": "CVE-2025-47912",
      "id": "msrc_CVE-2025-47912",
      "initial_release_date": "2025-10-31T01:05:35.000Z",
      "product_status:known_affected": "9",
      "product_status:known_not_affected": "9",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Insufficient validation of bracketed IPv6 hostnames in net/url",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-47912.json",
      "version": "10"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://pkg.go.dev",
                "defaultStatus": "unaffected",
                "packageName": "net/url",
                "product": "net/url",
                "programRoutines": [
                  {
                    "name": "parseHost"
                  },
                  {
                    "name": "JoinPath"
                  },
                  {
                    "name": "Parse"
                  },
                  {
                    "name": "ParseRequestURI"
                  },
                  {
                    "name": "URL.Parse"
                  },
                  {
                    "name": "URL.UnmarshalBinary"
                  }
                ],
                "vendor": "Go standard library",
                "versions": [
                  {
                    "lessThan": "1.24.8",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "1.25.2",
                    "status": "affected",
                    "version": "1.25.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@golang.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E1AB9501-4F7D-4E37-BA0A-4E57B082530C",
                    "versionEndExcluding": "1.24.8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C196D175-EF20-476C-8C64-1B9F5C50AA2D",
                    "versionEndExcluding": "1.25.2",
                    "versionStartIncluding": "1.25.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."
          },
          {
            "lang": "es",
            "value": "La funci\u00f3n Parse permite que se incluyan valores distintos de direcciones IPv6 entre corchetes dentro del componente de host de una URL. RFC 3986 permite que las direcciones IPv6 se incluyan dentro del componente de host, encerradas entre corchetes. Por ejemplo: \u0027http://[::1]/\u0027. Las direcciones IPv4 y los nombres de host no deben aparecer entre corchetes. Parse no aplic\u00f3 este requisito."
          }
        ],
        "id": "CVE-2025-47912",
        "lastModified": "2026-09-30T23:10:00.237",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-47912",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-30T20:37:56.865966Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-29T23:16:18.187",
        "references": [
          {
            "source": "security@golang.org",
            "tags": [
              "Patch"
            ],
            "url": "https://go.dev/cl/709857"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://go.dev/issue/75678"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Mailing List",
              "Release Notes"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2025-4010"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Release Notes"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2025/10/08/1"
          }
        ],
        "sourceIdentifier": "security@golang.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-10T04:00:27+00:00",
      "cve": "CVE-2025-47912",
      "id": "CVE-2025-47912",
      "initial_release_date": "2025-10-29T22:10:13.435000+00:00",
      "product_status:fixed": "8",
      "product_status:known_affected": "705",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "net/url: Insufficient validation of bracketed IPv6 hostnames in net/url",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-47912.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-04T21:10:57.384Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2025/10/08/1"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 5.3,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-47912",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-30T20:37:56.865966Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-30T20:38:16.889Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://pkg.go.dev",
              "defaultStatus": "unaffected",
              "packageName": "net/url",
              "product": "net/url",
              "programRoutines": [
                {
                  "name": "parseHost"
                },
                {
                  "name": "JoinPath"
                },
                {
                  "name": "Parse"
                },
                {
                  "name": "ParseRequestURI"
                },
                {
                  "name": "URL.Parse"
                },
                {
                  "name": "URL.UnmarshalBinary"
                }
              ],
              "vendor": "Go standard library",
              "versions": [
                {
                  "lessThan": "1.24.8",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "1.25.2",
                  "status": "affected",
                  "version": "1.25.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua University"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
                  "lang": "en"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-29T22:10:13.435Z",
            "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
            "shortName": "Go"
          },
          "references": [
            {
              "url": "https://go.dev/issue/75678"
            },
            {
              "url": "https://go.dev/cl/709857"
            },
            {
              "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
            },
            {
              "url": "https://pkg.go.dev/vuln/GO-2025-4010"
            }
          ],
          "title": "Insufficient validation of bracketed IPv6 hostnames in net/url"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "assignerShortName": "Go",
        "cveId": "CVE-2025-47912",
        "datePublished": "2025-10-29T22:10:13.435Z",
        "dateReserved": "2025-05-13T23:31:29.597Z",
        "dateUpdated": "2025-11-04T21:10:57.384Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.