Moderate Security Vulnerability in Python 3.12: URL Parser Allows Square Brackets in Domain Names
Summary
RLSA-2025:7107: Moderate: python3.12 security update. Affects python3.12 versions < 0:3.12.9-1.el9. Fixed in 0:3.12.9-1.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, and dynamic data types. It is widely used for various applications, including web development, data analysis, and automation. The specific vulnerability in Python 3.12 relates to its URL parser, which improperly allows square brackets in domain names, potentially leading to security issues.
Vulnerability Detail
The vulnerability, identified as CVE-2025-0938, originates from the URL parser in Python's cpython implementation. It allows square brackets in domain names, which can lead to unexpected behavior and security risks, such as the potential for malicious exploitation. The CVSS score for this vulnerability is 6.8, indicating a moderate severity level. This flaw could be exploited in scenarios where URL validation is critical, potentially allowing attackers to manipulate URLs for malicious purposes.
How To Fix
Minimum fixed version
0:3.12.9-1.el9
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to update to the patched version as mentioned above.
Conclusion
In summary, the vulnerability CVE-2025-0938 in Python 3.12 allows square brackets in domain names, posing a moderate security risk. Users are advised to update to the patched version to ensure their applications are secure.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2025-0938 is a security vulnerability in Python 3.12 that allows square brackets in domain names through its URL parser, potentially leading to security risks.
The vulnerability could allow attackers to exploit URL parsing in applications, leading to unexpected behavior or security breaches.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Users should update to the patched version 0:3.12.9-1.el9 to mitigate the vulnerability.
Currently, there are no specific workarounds available. Updating to the patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
