Moderate Security Vulnerability in Python3 Packages: URL Parser Issue
Summary
ALSA-2026:5588: Moderate: python3 security update. Affects platform-python versions < 3.6.8-74.el8_10.alma.1. Fixed in 3.6.8-74.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various system calls, libraries, and windowing systems, making it a popular choice for developers. The affected packages, including platform-python, platform-python-debug, platform-python-devel, python3-idle, python3-libs, python3-test, and python3-tkinter, are essential components of the Python ecosystem in AlmaLinux 8, providing core functionalities and libraries for Python applications.
Vulnerability Detail
The vulnerability arises from a flaw in the URL parser of the cpython implementation, which improperly allows square brackets in domain names. This could lead to potential security risks, such as the possibility of malicious URLs being processed, which may result in unauthorized access or data leakage. The issue is documented under CVE-2025-0938, highlighting its significance in maintaining the integrity and security of applications relying on Python.
How To Fix
Minimum fixed version
3.6.8-74.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update platform-pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using URLs with square brackets in domain names until the packages are updated. However, this is not a permanent solution and should only be used until the fix is applied.
Conclusion
In summary, the moderate security vulnerability in Python3 packages due to the URL parser flaw poses significant risks. It is crucial to update the affected packages to the patched version to ensure the security and integrity of applications. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for platform-python →
FAQ
CVE-2025-0938 is the identifier for the vulnerability in the Python URL parser that allows square brackets in domain names, posing security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential unauthorized access and data leakage due to the improper handling of URLs with square brackets.
Yes, a patch is available in version 3.6.8-74.el8_10.alma.1 for the affected Python packages.
If immediate updates are not possible, avoid using URLs with square brackets in domain names as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python.
