CVE-2025-47912

Description

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 0.44%• Percentile: 37%

Affected Systems

• chainguard•age

  < 1.2.1-r8

• chainguard•age-fips

  < 1.2.1-r8

• chainguard•amass

  < 5.0.1-r1

• chainguard•amazon-k8s-cni-fips

  < 1.20.4-r2

• chainguard•amazon-k8s-cni-init-fips

  < 1.20.4-r2

• chainguard•amazon-k8s-cni-init-fips-compat

  < 1.20.4-r2

• chainguard•ansible-operator

  < 1.41.0-r1

• chainguard•ansible-operator-compat

  < 1.41.0-r1

• chainguard•apisix-ingress-controller

  < 1.8.4-r4

• chainguard•apisix-ingress-controller-compat

  < 1.8.4-r4

• chainguard•apisix-ingress-controller-iamguarded-compat

  < 1.8.4-r4

• chainguard•apm-server-7.17

  < 7.17.29-r4

• chainguard•apm-server-7.17-compat

  < 7.17.29-r4

• chainguard•apm-server-8.17

  < 8.17.10-r2

• chainguard•apm-server-8.17-compat

  < 8.17.10-r2

• chainguard•apm-server-8.18

  < 8.18.8-r1

• chainguard•apm-server-8.18-compat

  < 8.18.8-r1

• chainguard•apm-server-fips-7.17

  < 7.17.29-r4

• chainguard•apm-server-fips-7.17-compat

  < 7.17.29-r4

• chainguard•apm-server-fips-8.17

  < 8.17.10-r1

• chainguard•apm-server-fips-8.17-compat

  < 8.17.10-r1

• chainguard•apm-server-fips-8.18

  < 8.18.8-r1

• chainguard•apm-server-fips-8.18-compat

  < 8.18.8-r1

• chainguard•apm-server-fips-9.0

  < 9.0.8-r1

• chainguard•apm-server-fips-9.0-compat

  < 9.0.8-r1

• chainguard•argo-cd-2.13-compat

  < 2.13.9-r2

• chainguard•argo-rollouts

  < 1.8.3-r4

• chainguard•argo-rollouts-fips

  < 1.8.3-r5

• chainguard•atlantis

  < 0.36.0-r2

• chainguard•auditbeat-fips-8.17

  < 8.17.10-r2

• chainguard•auditbeat-fips-8.18

  < 8.18.8-r2

• chainguard•auditbeat-fips-9.0

  < 9.0.8-r2

• chainguard•authservice-fips

  < 1.1.1-r1

• chainguard•authservice-fips-compat

  < 1.1.1-r1

• chainguard•aws-iam-authenticator

  < 0.7.8-r1

• chainguard•aws-iam-authenticator-fips

  < 0.7.8-r1

• chainguard•aws-node-termination-handler

  < 1.25.2-r2

• chainguard•aws-node-termination-handler-compat

  < 1.25.2-r2

• chainguard•aws-node-termination-handler-fips

  < 1.25.2-r2

• chainguard•aws-node-termination-handler-fips-compat

  < 1.25.2-r2

• chainguard•aws-privateca-issuer-compat-fips

  < 1.7.0-r3

• chainguard•aws-privateca-issuer-fips

  < 1.7.0-r3

• chainguard•aws-s3-controller

  < 1.1.1-r1

• chainguard•aws-signer-notation-plugin

  < 1.0.2292-r3

• chainguard•aws-signer-notation-plugin-fips

  < 1.0.2292-r3

• chainguard•aws-sigv4-proxy

  < 1.10-r3

• chainguard•aws-sigv4-proxy-compat

  < 1.10-r3

• chainguard•aws-sigv4-proxy-fips

  < 1.10-r3

• chainguard•aws-sigv4-proxy-fips-compat

  < 1.10-r3

• chainguard•azure-aad-pod-identity-mic

  < 1.8.17-r28

Showing first 50 affected entries in server-rendered view.

References (9)

• https://go.dev/issue/75678
• https://go.dev/cl/709857
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
• https://pkg.go.dev/vuln/GO-2025-4010
• http://www.openwall.com/lists/oss-security/2025/10/08/1
• https://security-tracker.debian.org/tracker/CVE-2025-47912
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47912.json
• https://nvd.nist.gov/vuln/detail/CVE-2025-47912