Vulnerability in PyPy3 and Python3: Invalid Domain Name Parsing
Summary
CVE-2025-0938: The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names that included square brackets which isn't valid according to RFC 3986. Affects python3 across 7 version ranges.
< 3.11.12-r0
< 90e526ae67b172ed7c6c56e7edad36263b0f9403
< 526617ed68cde460236c973e5d0a8bad4de896ba
< a7084f6075c9595ba60119ce8c62f1496f50c568
< b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab
< d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a
< ff4e5c25666f63544071a6b075ae8b25c98b7a32
Fixed in 3.11.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyPy3 and Python3 are popular implementations of the Python programming language, known for their performance and compatibility with Python code. They provide a wide range of libraries and functionalities, including URL parsing through the standard library. However, a recent vulnerability has been identified in the URL parsing functions, which could lead to inconsistencies in how URLs are processed, particularly those containing invalid domain names with square brackets.
Vulnerability Detail
The vulnerability arises from the Python standard library functions urllib.parse.urlsplit and urlparse, which incorrectly accept domain names that include square brackets. According to RFC 3986, square brackets are only valid as delimiters for IPv6 and IPvFuture hosts in URLs. This flaw can lead to differential parsing between the Python URL parser and other compliant URL parsers, potentially causing unexpected behavior in applications that rely on URL parsing.
How To Fix
Minimum fixed version
3.11.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using URLs with square brackets in domain names until the packages can be updated. Validate and sanitize URLs before processing them in your application to prevent any potential issues.
Conclusion
The vulnerability CVE-2025-0938 poses a risk to applications using PyPy3 and Python3 due to improper URL parsing. It is crucial to update to the patched versions of the affected packages and to implement workarounds as necessary to mitigate potential issues.
See every vulnerability recorded for python3 →
FAQ
CVE-2025-0938 is a vulnerability in the Python standard library that allows invalid domain names with square brackets to be parsed, leading to potential inconsistencies.
The affected packages include PyPy3 and various versions of Python3 (3.9, 3.11, 3.12, and 3.13) in Debian ecosystems.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, ensure to validate and sanitize URLs to avoid using those with square brackets in domain names as a temporary measure.
More detailed information can be found in the CVE database and through the official Python and PyPy documentation.
Related vulnerabilities
Recent vulnerabilities recorded for python3.
