CVE-2024-11168

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
Python Software FoundationCPython< 3.9.21; >= 3.10.0, < 3.10.16; >= 3.11.0, < 3.11.4; >= 3.12.0a1, < 3.12.0b1
python_software_foundationcpython< 3.11.4; >= 3.12.0a1, < 3.12.0b1

References

Timeline

Published
Nov 12, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-111697.5An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exCVE-2024-11179.8A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of tCVE-2024-111708.8A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the mulCVE-2024-111717.5In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware foCVE-2024-111727.5A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crCVE-2024-111736.5An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denialCVE-2024-111754.8A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /adCVE-2024-111765.3Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information viCVE-2024-111788.1The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the pCVE-2024-111796.5The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parCVE-2024-11188.8The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscCVE-2024-111805.4The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_count