CVE-2025-47912: falha de média gravidade em Go standard library net/url
Insufficient validation of bracketed IPv6 hostnames in net/url
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Go standard library · net/urlCVEs relacionadas — Go standard library net/url
No mesmo produto, das mais perigosas para as menos.
CVE-2025-61726HIGHMemory exhaustion in query parameter parsing in net/urlEPSS 2.3%CVE-2022-32190—Failure to strip relative path components in net/urlEPSS 2.2%CVE-2026-25679HIGHIncorrect parsing of IPv6 host literals in net/urlEPSS 0.8%CVE-2026-56860MEDIUMAvoid quadratic complexity in resolvePath in net/urlEPSS 0.5%