CVE-2024-45341 Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New CVEs Address IPv6 Vulnerabilities in Microsoft Products Two new Common Vulnerabilities and Exposures (CVEs) have been published regarding IPv6 vulnerabilities in Microsoft products. CVE-2024-45341, published on January 28, 2025, involves the usage of IPv6 zone IDs that can bypass URI name constraints in crypto/x509. CVE-2025-47912, published on October 29, 2025, pertains to insufficient validation of bracketed IPv6 hostnames in net/url. 2 sources 39