Description

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

INFO

Published Date :

2024-11-12T21:22:23.438Z

Last Modified :

2025-11-03T21:51:45.721Z

Source :

PSF
AFFECTED PRODUCTS

The following products are affected by CVE-2024-11168 vulnerability.

Vendors Products
Python Software Foundation
  • Cpython
Redhat
  • Enterprise Linux
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-11168.

URL Resource
https://github.com/python/cpython/commit/29f348e232e82938ba2165843c448c2b291504c5 cve-icon cve-icon cve-icon
https://github.com/python/cpython/commit/634ded45545ce8cbd6fd5d49785613dd7fa9b89e cve-icon cve-icon
https://github.com/python/cpython/commit/b2171a2fd41416cf68afd67460578631d755a550 cve-icon cve-icon cve-icon
https://github.com/python/cpython/commit/ddca2953191c67a12b1f19d6bca41016c6ae7132 cve-icon cve-icon
https://github.com/python/cpython/issues/103848 cve-icon cve-icon cve-icon
https://github.com/python/cpython/pull/103849 cve-icon cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html cve-icon
https://mail.python.org/archives/list/[email protected]/thread/XPWB6XVZ5G5KGEI63M4AWLIEUF5BPH4T/ cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-11168 cve-icon
https://security.netapp.com/advisory/ntap-20250411-0004/ cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-11168 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact