logo

Database

Asymmetric denial of service In python3

Description

The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 27

10

Aliases

1. CVE-2025-09382. NVD-2025-09383. OSV-ALPINE-2025-09384. OSV-2025-09385. OSV-DEBIAN-2025-09386. GCVE-2025-09387. SECURITY-CVE-2025-09388. SECURITY-TRACKER-CVE-2025-09389. lists.debian.org10. https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0938.json11. mail.python.org12. security.netapp.com

References

1. https://github.com/python/cpython/issues/1057042. https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba3. https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f94034. https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c5685. https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab6. https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a7. https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a328. https://github.com/python/cpython/pull/129418

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.