Improper input validation in Python Software Foundation Cpython
CVE-2025-0938
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.015 (71.6th percentile) — read the EPSS interpretation.
Affected products
- Python Software Foundation Cpython — versions 3.10.0, 0, 3.14.0a1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@python.org (issue-tracking)
- cna@python.org (patch)
- cna@python.org (vendor-advisory)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-0938?
- CVE-2025-0938 is a vulnerability in Python Software Foundation Cpython, classified under Improper Input Validation. Published 2025-01-31.
- Is CVE-2025-0938 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.