Critical Vulnerability in Python Standard Library: URL Parsing Issue in urllib
Summary
UBUNTU-CVE-2025-0938: The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names that included square brackets which isn't valid according to RFC 3986. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm28. Fixed in 2.7.6-8ubuntu0.6+esm28. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The urllib module in Python's standard library is essential for working with URLs, providing functions to parse, construct, and manipulate URLs. However, a recent vulnerability has been identified in the urlsplit and urlparse functions, which could lead to improper URL parsing, potentially affecting applications that rely on these functions for URL handling.
Vulnerability Detail
The vulnerability arises from the acceptance of domain names containing square brackets in the urllib.parse.urlsplit and urlparse functions, which is not compliant with RFC 3986. This non-compliance can lead to differential parsing between Python's URL parser and other specification-compliant parsers, resulting in unexpected behavior or security issues in applications that handle URLs. The implications of this vulnerability could range from incorrect URL handling to potential security risks if malicious URLs are processed incorrectly.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm28
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation to ensure that URLs do not contain square brackets before processing them with the urlsplit or urlparse functions. This can be done using regular expressions to filter out invalid URLs.
Conclusion
In summary, the vulnerability in Python's urllib module poses significant risks due to improper URL parsing. It is crucial for developers to update their packages to the patched versions and implement necessary workarounds to ensure the security and reliability of their applications.
See every vulnerability recorded for python2.7 →
FAQ
The vulnerability allows the urllib.parse.urlsplit and urlparse functions to accept invalid domain names containing square brackets, leading to potential security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The consequences may include incorrect URL parsing, unexpected application behavior, and potential security risks if malicious URLs are processed.
Yes, patched versions of the affected Python packages are available. It is recommended to update to these versions to mitigate the vulnerability.
If immediate updates are not possible, implement input validation to filter out invalid URLs as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
