CVE-2025-47912: 
Golang vulnerability analysis and mitigation

The vulnerability CVE-2025-47912 affects the Go programming language's net/url package, specifically related to insufficient validation of bracketed IPv6 hostnames. The issue was discovered by researchers Enze Wang, Jingcheng Yang, and Zehui Miao from Tsinghua University and was publicly disclosed on October 7, 2025 (Golang Announce).

The vulnerability exists in the Parse function of the net/url package, which incorrectly permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL. While RFC 3986 specifically permits IPv6 addresses to be included within the host component enclosed in square brackets (e.g., 'http://[::1]/'), the implementation failed to enforce the requirement that IPv4 addresses and hostnames must not appear within square brackets (Github Issue).

The vulnerability affects multiple versions of Go, including Go 1.15 through Go 1.24. Various distributions were impacted, including Debian's bullseye (1.15.15-1~deb11u4), bookworm (1.19.8-2), and trixie (1.24.4-1) releases (Debian Tracker).

The vulnerability has been patched in Go versions 1.25.2 and 1.24.8. The fixes are available through commits 9fd3ac8a10272afd90312fef5d379de7d688a58e (for Go 1.25.2) and d6d2f7bf76718f1db05461cd912ae5e30d7b77ea (for Go 1.24.8). Users are advised to upgrade to these patched versions (Golang Announce).