CVE-2024-11168

Improper validation of IPv6 and IPvFuture addresses

Medium · published November 12, 2024

CVSS v4.0
6.3
EPSS
1%
Percentile
50.8
In the wild
Unconfirmed
What it is

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/AU:N
EPSS
0.00656 · 50.8th percentile
Published
2024-11-12T21:22Z
EPSS history
Timeline
  • 12 NOV 21:22Z
    Improper validation of IPv6 and IPvFuture addresses
    cvelistv5