CVE-2025-47912: Golang Package Suffers from Insufficient Validation of Bracketed IPv6 Hostnames
Summary
CVE-2025-47912: Insufficient validation of bracketed IPv6 hostnames in net/url. Affects golang across 2 version ranges.
< 1.24.8
>= 1.25.0, < 1.25.2
Fixed in 1.24.8 or 1.25.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-47912 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Golang package, developed by Google, is a widely-used programming language known for its simplicity and efficiency in building web servers, data pipelines, and other applications. It provides a robust standard library, including the net/url package for URL parsing. However, a vulnerability has been identified in the Parse function of the net/url package, which fails to properly validate bracketed IPv6 hostnames, allowing for potential misuse.
Vulnerability Detail
The vulnerability arises from the Parse function's leniency in accepting values other than valid IPv6 addresses within square brackets in the host component of a URL. According to RFC 3986, only IPv6 addresses should be enclosed in square brackets, while IPv4 addresses and hostnames must not. This oversight can lead to security issues, such as the potential for injection attacks or misrouting of network traffic, as the function does not enforce strict validation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.24.81.24.8 -
>= 1.25.0, < 1.25.21.25.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that any URLs being parsed do not include invalid bracketed hostnames. You can implement a validation check in your code to verify that only valid IPv6 addresses are used within square brackets before passing them to the Parse function.
Conclusion
The CVE-2025-47912 vulnerability in the Golang package highlights the importance of strict validation in URL parsing. By updating to the patched versions and implementing additional validation checks, developers can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for golang →
FAQ
CVE-2025-47912 is a vulnerability in the Golang package that allows insufficient validation of bracketed IPv6 hostnames, potentially leading to security risks.
If your application uses the affected versions of the Golang package, it may be susceptible to injection attacks or misrouting due to improper URL parsing.
The affected versions are prior to 1.24.8 and 1.25.0, specifically 1.24.0 to 1.24.7 and 1.25.0 to 1.25.1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If immediate updates are not feasible, implement validation checks in your code to ensure that only valid IPv6 addresses are used within square brackets.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
