CVE-2025-0938 URL parser allowed square brackets in domain names
Python's URL parser incorrectly accepted square brackets in domain names, potentially causing differential parsing issues compared to compliant parsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-0938?
CVE-2025-0938 is a medium-severity vulnerability in CPython, published on 31 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
Weakness: CWE-20
Which versions are affected by CVE-2025-0938?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.9.22, 3.10.17, 3.11.12, 3.12.9, 3.13.2 |
python Bitnami | All versions | 3.9.22, 3.10.17, 3.11.12, 3.12.9, 3.13.2 |
python-min Bitnami | All versions | 3.9.22, 3.10.17, 3.11.12, 3.12.9, 3.13.2 |
Linux distribution packages (37)
platform-python AlmaLinux:8 | All versions | 3.6.8-74.el8_10.alma.1 |
platform-python-debug AlmaLinux:8 | All versions | 3.6.8-74.el8_10.alma.1 |
platform-python-devel AlmaLinux:8 | All versions | 3.6.8-74.el8_10.alma.1 |
python3-idle AlmaLinux:8 | All versions | 3.6.8-74.el8_10.alma.1 |
python3-libs AlmaLinux:8 | All versions | 3.6.8-74.el8_10.alma.1 |
python3-test AlmaLinux:8 | All versions | 3.6.8-74.el8_10.alma.1 |
python3-tkinter AlmaLinux:8 | All versions | 3.6.8-74.el8_10.alma.1 |
python-unversioned-command AlmaLinux:9 | All versions | 3.9.21-2.el9 |
python3 AlmaLinux:9 | All versions | 3.9.21-2.el9 |
python3-debug AlmaLinux:9 | All versions | 3.9.21-2.el9 |
python3-devel AlmaLinux:9 | All versions | 3.9.21-2.el9 |
python3-idle AlmaLinux:9 | All versions | 3.9.21-2.el9 |
python3-libs AlmaLinux:9 | All versions | 3.9.21-2.el9 |
python3-test AlmaLinux:9 | All versions | 3.9.21-2.el9 |
python3-tkinter AlmaLinux:9 | All versions | 3.9.21-2.el9 |
python3.11 AlmaLinux:9 | All versions | 3.11.11-2.el9 |
python3.11-debug AlmaLinux:9 | All versions | 3.11.11-2.el9 |
python3.11-devel AlmaLinux:9 | All versions | 3.11.11-2.el9 |
python3.11-idle AlmaLinux:9 | All versions | 3.11.11-2.el9 |
python3.11-libs AlmaLinux:9 | All versions | 3.11.11-2.el9 |
python3.11-test AlmaLinux:9 | All versions | 3.11.11-2.el9 |
python3.11-tkinter AlmaLinux:9 | All versions | 3.11.11-2.el9 |
python3.12 AlmaLinux:9 | All versions | 3.12.9-1.el9 |
python3.12-debug AlmaLinux:9 | All versions | 3.12.9-1.el9 |
python3.12-devel AlmaLinux:9 | All versions | 3.12.9-1.el9 |
python3.12-idle AlmaLinux:9 | All versions | 3.12.9-1.el9 |
python3.12-libs AlmaLinux:9 | All versions | 3.12.9-1.el9 |
python3.12-test AlmaLinux:9 | All versions | 3.12.9-1.el9 |
python3.12-tkinter AlmaLinux:9 | All versions | 3.12.9-1.el9 |
platform-python Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-74.el8_10 |
platform-python-debug Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-74.el8_10 |
platform-python-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-74.el8_10 |
python3-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-74.el8_10 |
python3-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-74.el8_10 |
python3-idle Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-74.el8_10 |
python3-test Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-74.el8_10 |
python3-tkinter Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-74.el8_10 |
How do I fix CVE-2025-0938?
Upgrade libpython to a fixed version for your release line: 3.9.22, 3.10.17, 3.11.12 or 3.12.9.
Is CVE-2025-0938 being exploited?
There is no known exploitation of CVE-2025-0938 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-0938, ALSA-2025:6977, ALSA-2025:7107, ALSA-2025:7109, ALSA-2026:5588, AZL-56231 and 51 more.