Python up to 3.14.0a3 URL Parser urllib.parse.urlsplit/urlparse input validation

Summaryinfo

A vulnerability has been found in Python up to 3.14.0a3 and classified as problematic. This vulnerability affects the function urllib.parse.urlsplit/urlparse of the component URL Parser. Performing a manipulation results in input validation. This vulnerability is reported as CVE-2025-0938. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Python up to 3.14.0a3. It has been classified as problematic. This affects the function urllib.parse.urlsplit/urlparse of the component URL Parser. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. The impact remains unknown. The summary by CVE is:

The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-0938 since 01/31/2025. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 215170 (openSUSE 15 Security Update : python39 (SUSE-SU-2025:0386-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.14.0a4 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (215170) and CERT Bund (WID-SEC-2025-0233). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Xerox FreeFlow Print Server
• Oracle Linux
• NetApp ActiveIQ Unified Manager
• SUSE openSUSE
• RESF Rocky Linux
• IBM App Connect Enterprise
• Open Source Python
• Dell Avamar
• NetApp Data ONTAP
• Dell PowerProtect Data Domain
• Dell NetWorker

Productinfo

Type

• Programming Language Software

Name

• Python

Version

• 3.14.0a3

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion