In breve
- CVE-2025-47912 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda stdlib, go (golang).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.47%, superiore al 40.5% delle vulnerabilità.
- Correzione: aggiornare a 1.25.2, 1.24.8 o successiva.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.25.0, < 1.25.2< 1.24.8
| 1.25.21.24.8
|
| go | ≥ 1.25.0, < 1.25.2< 1.24.8
| 1.25.21.24.8
|
Description
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
NVD description
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free