CVE-2024-11168 MEDIUM

CVE-2024-11168: Improper validation of IPv6 and IPvFuture addresses

Vendor Python Software Foundation
Product CPython
Published November 12, 2024
Last update November 3, 2025
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/AU:N

What the vulnerability does

01Description

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

Key dates

02Disclosure timeline

November 12, 2024 CVE published
November 3, 2025 Record updated