UNKNOWN Go
Insufficient validation of bracketed IPv6 hostnames in net/url
GO-2025-4010 · BIT-golang-2025-47912 · CVE-2025-47912
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes