CVE-2025-47912 - CVE House

Back to Database

Status published Unknown CVE-2025-47912

Insufficient validation of bracketed IPv6 hostnames in net/url

0 CVSS

Vulnerability Description

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-47912

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua University

References

More from Go standard library

View All →

Unexpected session resumption in crypto/tls

Handshake messages may be processed at the incorrect encryption level in crypto/tls

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Excessive CPU consumption when building archive index in archive/zip

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

Affected Vendor

Go standard library

View all reports →

Affected Software

net/url

Vulnerable Versions:

0, 1.25.0

Timeline

Official Publish: October 29th, 2025

Last Modified: November 4th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.