CVE-2025-47912: Insufficient validation of bracketed IPv6 hostnames in net/url
Insufficient validation of bracketed IPv6 hostnames in net/url
Other sources
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47912?
CVE-2025-47912 is considered to have a moderate severity due to potential risks in URL parsing.
How do I fix CVE-2025-47912?
To fix CVE-2025-47912, ensure that your software is updated to the latest versions that address this vulnerability.
Which products are affected by CVE-2025-47912?
CVE-2025-47912 affects Microsoft azl3 golang and cbl2 golang versions as specified in the vulnerability details.
What is the main issue with CVE-2025-47912?
The main issue with CVE-2025-47912 is insufficient validation of bracketed IPv6 hostnames in the URL parsing logic.
Is CVE-2025-47912 likely to be exploited?
While CVE-2025-47912 has potential security implications, the likelihood of exploitation depends on specific usage scenarios.