Skip to content

Commit 6cc7780

Browse files
neildgopherbot
neild
authored and
gopherbot
committed
data/reports: add GO-2025-4010
 - data/reports/GO-2025-4010.yaml Fixes #4010 Change-Id: I0ca5a78fec57fac5088987e919761181cc7d7352 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/715921 Reviewed-by: Roland Shoemaker <[email protected]> Auto-Submit: Damien Neil <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent 689e8ab commit 6cc7780

File tree

3 files changed

+212
-0
lines changed

3 files changed

+212
-0
lines changed

‎data/cve/v5/GO-2025-4010.json‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2025-47912"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "Insufficient validation of bracketed IPv6 hostnames in net/url",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "Go standard library",
22+
"product": "net/url",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "net/url",
25+
"versions": [
26+
{
27+
"version": "0",
28+
"lessThan": "1.24.8",
29+
"status": "affected",
30+
"versionType": "semver"
31+
},
32+
{
33+
"version": "1.25.0",
34+
"lessThan": "1.25.2",
35+
"status": "affected",
36+
"versionType": "semver"
37+
}
38+
],
39+
"programRoutines": [
40+
{
41+
"name": "parseHost"
42+
},
43+
{
44+
"name": "JoinPath"
45+
},
46+
{
47+
"name": "Parse"
48+
},
49+
{
50+
"name": "ParseRequestURI"
51+
},
52+
{
53+
"name": "URL.Parse"
54+
},
55+
{
56+
"name": "URL.UnmarshalBinary"
57+
}
58+
],
59+
"defaultStatus": "unaffected"
60+
}
61+
],
62+
"problemTypes": [
63+
{
64+
"descriptions": [
65+
{
66+
"lang": "en",
67+
"description": "CWE-1286: Improper Validation of Syntactic Correctness of Input"
68+
}
69+
]
70+
}
71+
],
72+
"references": [
73+
{
74+
"url": "https://go.dev/issue/75678"
75+
},
76+
{
77+
"url": "https://go.dev/cl/709857"
78+
},
79+
{
80+
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
81+
},
82+
{
83+
"url": "https://pkg.go.dev/vuln/GO-2025-4010"
84+
}
85+
],
86+
"credits": [
87+
{
88+
"lang": "en",
89+
"value": "Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua University"
90+
}
91+
]
92+
}
93+
}
94+
}

‎data/osv/GO-2025-4010.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4010",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-47912",
8+
"CVE-2025-47912"
9+
],
10+
"summary": "Insufficient validation of bracketed IPv6 hostnames in net/url",
11+
"details": "The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "stdlib",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.24.8"
27+
},
28+
{
29+
"introduced": "1.25.0"
30+
},
31+
{
32+
"fixed": "1.25.2"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {
38+
"imports": [
39+
{
40+
"path": "net/url",
41+
"symbols": [
42+
"JoinPath",
43+
"Parse",
44+
"ParseRequestURI",
45+
"URL.Parse",
46+
"URL.UnmarshalBinary",
47+
"parseHost"
48+
]
49+
}
50+
]
51+
}
52+
}
53+
],
54+
"references": [
55+
{
56+
"type": "REPORT",
57+
"url": "https://go.dev/issue/75678"
58+
},
59+
{
60+
"type": "FIX",
61+
"url": "https://go.dev/cl/709857"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
66+
}
67+
],
68+
"credits": [
69+
{
70+
"name": "Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua University"
71+
}
72+
],
73+
"database_specific": {
74+
"url": "https://pkg.go.dev/vuln/GO-2025-4010",
75+
"review_status": "REVIEWED"
76+
}
77+
}

‎data/reports/GO-2025-4010.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
id: GO-2025-4010
2+
modules:
3+
- module: std
4+
versions:
5+
- fixed: 1.24.8
6+
- introduced: 1.25.0
7+
- fixed: 1.25.2
8+
vulnerable_at: 1.25.1
9+
packages:
10+
- package: net/url
11+
symbols:
12+
- parseHost
13+
derived_symbols:
14+
- JoinPath
15+
- Parse
16+
- ParseRequestURI
17+
- URL.Parse
18+
- URL.UnmarshalBinary
19+
summary: Insufficient validation of bracketed IPv6 hostnames in net/url
20+
description: |-
21+
The Parse function permits values other than IPv6 addresses to
22+
be included in square brackets within the host component of a
23+
URL. RFC 3986 permits IPv6 addresses to be included within the
24+
host component, enclosed within square brackets. For example:
25+
"http://[::1]/". IPv4 addresses and hostnames must not appear
26+
within square brackets. Parse did not enforce this requirement.
27+
cves:
28+
- CVE-2025-47912
29+
credits:
30+
- Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua University
31+
references:
32+
- report: https://go.dev/issue/75678
33+
- fix: https://go.dev/cl/709857
34+
- web: https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
35+
cve_metadata:
36+
id: CVE-2025-47912
37+
cwe: 'CWE-1286: Improper Validation of Syntactic Correctness of Input'
38+
source:
39+
id: go-security-team
40+
created: 2025-10-28T18:25:39.603085-07:00
41+
review_status: REVIEWED

0 commit comments

Comments
 (0)