GO-2025-4010

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2025-4010
Import Source
https://vuln.go.dev/ID/GO-2025-4010.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2025-4010
Aliases
Published
2025-10-29T21:49:58Z
Modified
2025-11-06T13:59:58.375627Z
Summary
Insufficient validation of bracketed IPv6 hostnames in net/url
Details

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.

Database specific 
{
    "url": "https://pkg.go.dev/vuln/GO-2025-4010",
    "review_status": "REVIEWED"
}
References
Credits
    • Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua University

Affected packages

Go / stdlib

Package

Name
stdlib
View open source insights on deps.dev
Purl
pkg:golang/stdlib

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.24.8
Introduced
1.25.0
Fixed
1.25.2

Ecosystem specific 

{
    "imports": [
        {
            "path": "net/url",
            "symbols": [
                "JoinPath",
                "Parse",
                "ParseRequestURI",
                "URL.Parse",
                "URL.UnmarshalBinary",
                "parseHost"
            ]
        }
    ]
}