CVE-2025-47912: Insufficient Validation of Bracketed IPv6 Hostnames in net/url Package
Summary
CVE-2025-47912: Insufficient validation of bracketed IPv6 hostnames in net/url. Affects stdlib across 2 version ranges.
< 1.24.8
>= 1.25.0, < 1.25.2
Fixed in 1.24.8 or 1.25.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-47912 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/url package in Go is responsible for parsing URLs and handling various URL-related functionalities. It allows developers to work with URLs in a structured manner, supporting both IPv4 and IPv6 addresses. However, the package has a vulnerability that arises from insufficient validation of bracketed IPv6 hostnames, which can lead to improper handling of URLs and potential security issues.
Vulnerability Detail
The vulnerability exists in the Parse function of the net/url package, which allows values other than valid IPv6 addresses to be included within square brackets in the host component of a URL. According to RFC 3986, only IPv6 addresses should be enclosed in square brackets, while IPv4 addresses and hostnames should not. This lack of enforcement can lead to unexpected behavior and security risks, as it may allow malicious inputs to be processed without proper validation.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.24.81.24.8go get stdlib@v1.24.8 -
>= 1.25.0, < 1.25.21.25.2go get stdlib@v1.25.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that any URLs being parsed do not contain bracketed values that are not valid IPv6 addresses. You can implement a validation check before passing URLs to the Parse function, for example:
if strings.Contains(url, "[") && !isValidIPv6(url) {
// Handle invalid URL
}
Where isValidIPv6 is a custom function you would implement to validate IPv6 addresses.
Conclusion
The CVE-2025-47912 vulnerability in the net/url package poses a significant risk due to insufficient validation of bracketed IPv6 hostnames. It is crucial to update to the patched versions to mitigate potential security threats and ensure proper URL handling.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-47912 is a vulnerability in the net/url package of Go that allows insufficient validation of bracketed IPv6 hostnames.
If your application uses the net/url package to parse URLs, it may be susceptible to unexpected behavior or security risks due to improper validation of URLs.
The vulnerability affects versions prior to 1.24.8 and 1.25.2 of the net/url package.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, implement a validation check to ensure that any URLs being parsed do not contain invalid bracketed values.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
