QwikSec

Security Database

CVE

CWE

Training

CVE-2024-11168

Published: Nov 12, 2024

Modified: Nov 3, 2025

PUBLISHED

Description

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

Vendor	Product	Versions
Python Software Foundation	CPython	affected `0 - < 3.9.21` affected `3.10.0 - < 3.10.16` affected `3.11.0 - < 3.11.4` affected `3.12.0a1 - < 3.12.0b1`

References

https://github.com/python/cpython/commit/29f348e232e82938ba2165843c448c2b291504c5

patch

https://github.com/python/cpython/pull/103849

patch

https://github.com/python/cpython/issues/103848

issue-tracking

https://mail.python.org/archives/list/[email protected]/thread/XPWB6XVZ5G5KGEI63M4AWLIEUF5BPH4T/

vendor-advisory

https://github.com/python/cpython/commit/b2171a2fd41416cf68afd67460578631d755a550

patch

https://github.com/python/cpython/commit/634ded45545ce8cbd6fd5d49785613dd7fa9b89e

patch

https://github.com/python/cpython/commit/ddca2953191c67a12b1f19d6bca41016c6ae7132

patch

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.