Vulnerability Description
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Go | < 1.24.8 |
References
- https://go.dev/cl/709857Patch
- https://go.dev/issue/75678Issue Tracking
- https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bIMailing ListRelease Notes
- https://pkg.go.dev/vuln/GO-2025-4010Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/10/08/1Mailing ListRelease Notes
FAQ
What is CVE-2025-47912?
CVE-2025-47912 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host compone...
How severe is CVE-2025-47912?
CVE-2025-47912 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-47912?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Go.