CVE-2025-47912

low-risk

Published 2025-10-29

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Golang

References (5)

Patch https://go.dev/cl/709857

Issue Tracking https://go.dev/issue/75678

Mailing List https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

Vendor Advisory https://pkg.go.dev/vuln/GO-2025-4010

Mailing List http://www.openwall.com/lists/oss-security/2025/10/08/1

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal