CVE-2025-47912: go — Fix

Description

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.

Is your site exposed to CVE-2025-47912?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products

Vendor	Product	Versions
golang	go	< 1.24.8
golang	go	1.25.0 — 1.25.2

References

Advisories & Patches

https://go.dev/cl/709857 https://pkg.go.dev/vuln/GO-2025-4010

Other References

https://go.dev/issue/75678 https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI http://www.openwall.com/lists/oss-security/2025/10/08/1

Frequently Asked Questions

What is CVE-2025-47912? +

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2025-47912? +

CVE-2025-47912 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-47912? +

CVE-2025-47912 affects products from golang, specifically: go. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-47912? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-46595 10.0

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other …

CVE-2024-24790 9.8

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses …

CVE-2026-42508 9.1

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' …

CVE-2026-39832 9.1

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination …

CVE-2026-39834 9.1

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the …

CVE-2026-39833 9.1

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would …

CVE-2025-47912