Improper input validation in Python Software Foundation Cpython

CVE-2025-0938

The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published · last modified .

EPSS exploit prediction

EPSS: 0.016 (74.3th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 74.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-0938: held from 0.016 to 0.016.

EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-0938?
CVE-2025-0938 is a vulnerability in Python Software Foundation Cpython, classified under Improper Input Validation. Published 2025-01-31.
Is CVE-2025-0938 known to be exploited?
3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.