CVE-2024-11168

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-111697.5An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an ex CVE-2024-11179.8A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of t CVE-2024-111708.8A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the mul CVE-2024-111717.5In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware fo CVE-2024-111727.5A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a cr CVE-2024-111736.5An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial CVE-2024-111754.8A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /ad CVE-2024-111765.3Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information vi CVE-2024-111788.1The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the p CVE-2024-111796.5The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' par CVE-2024-11188.8The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subsc CVE-2024-111805.4The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_count