En bref
- CVE-2025-47912 est une vulnérabilité MOYENNE (CVSS 5.3) touchant stdlib, go (golang).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.47%, plus élevée que 40.5% des vulnérabilités.
- Correctif : mettre à jour vers 1.25.2, 1.24.8 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.25.0, < 1.25.2< 1.24.8
| 1.25.21.24.8
|
| go | ≥ 1.25.0, < 1.25.2< 1.24.8
| 1.25.21.24.8
|
Description
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
NVD description
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free