CVE-2025-47912 Insufficient validation of bracketed IPv6 hostnames in net/url

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New CVEs Address IPv6 Vulnerabilities in Microsoft Products Two new Common Vulnerabilities and Exposures (CVEs) have been published regarding IPv6 vulnerabilities in Microsoft products. CVE-2024-45341, published on January 28, 2025, involves the usage of IPv6 zone IDs that can bypass URI name constraints in crypto/x509. CVE-2025-47912, published on October 29, 2025, pertains to insufficient validation of bracketed IPv6 hostnames in net/url. 2 sources 39