CVE-2024-11168 — Server-Side Request Forgery in Software Foundation Cpython

CWE-918 — Server-Side Request ForgeryCWE-1287 — Improper Validation of Specified Type of Input13 documents8 sources
Severity
6.3MEDIUMNVD
EPSS
0.6%
top 30.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Python Software Foundation Cpython
Timeline
PublishedNov 12
Latest updateSep 29

Description

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Affected Packages1 packages

▶CVEListV5python_software_foundation/cpython3.10.0 — 3.10.16+3

🔴Vulnerability Details

5
OSV
python2.7 regression↗2025-09-29
▶
OSV
python vulnerabilities↗2025-05-06
▶
GHSA
GHSA-qxg5-mcmp-m3m9: The urllib↗2024-11-13
▶
CVEList
Improper validation of IPv6 and IPvFuture addresses↗2024-11-12
▶
OSV
CVE-2024-11168: The urllib↗2024-11-12
▶

📋Vendor Advisories

7
Ubuntu
Python 2.7 regression↗2025-09-29
▶
Ubuntu
Python vulnerabilities↗2025-05-06
▶
Ubuntu
Python vulnerabilities↗2025-03-12
▶
Ubuntu
Python vulnerability↗2025-01-20
▶
Red Hat
python: Improper validation of IPv6 and IPvFuture addresses↗2024-11-12
▶
CVE-2024-11168 — Server-Side Request Forgery | cvebase