VDB
DEBIAN-CVE-2025-47912
DEBIAN-CVE-2025-47912
PUBLISHED
CVSS 5.300000190734863 MEDIUM
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | golang-1.19 | 1.19.13-1~bpo11+1, 1.19.8-2, 1.19.9-1 |
| Debian:14 | golang-1.25 | 1.25.1-1, 1.25.0-2, 1.25.0-1 |
| Debian:11 | golang-1.15 | 1.15.15-1~deb11u3, 0, 1.15.15-1 |
| Debian:13 | golang-1.24 | 1.24.8-1, 1.24.9-1, 1.24.7-1 |
Exploit Intelligence
- 4593.2.0.yml (github-poc)
Timeline
- Oct 29, 2025 CVE Published
- Apr 28, 2026 CVE Updated