CVE-2024-11168: Improper validation of IPv6 and IPvFuture addresses

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-12 · updated 2026-06-17
Weakness: CWE-918

Description

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

Affected products

Python Software Foundation Cpython: before 3.11.4; from 3.12.0a1 before 3.12.0b1 — fixed in 3.11.4, 3.12.0b1

How to fix

Upgrade to a fixed version: Python Software Foundation Cpython 3.11.4, 3.12.0b1. Check the vendor advisory for mitigations.

References

https://github.com/python/cpython/commit/29f348e232e82938ba2165843c448c2b291504c5
https://github.com/python/cpython/commit/634ded45545ce8cbd6fd5d49785613dd7fa9b89e
https://github.com/python/cpython/commit/b2171a2fd41416cf68afd67460578631d755a550
https://github.com/python/cpython/commit/ddca2953191c67a12b1f19d6bca41016c6ae7132
https://github.com/python/cpython/issues/103848
https://github.com/python/cpython/pull/103849
https://mail.python.org/archives/list/security-announce@python.org/thread/XPWB6XVZ5G5KGEI63M4AWLIEUF5BPH4T/
https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
https://security.netapp.com/advisory/ntap-20250411-0004/

Get alerted when CVE-2024-11168 or the next vulnerability affects your stack