- CVE-2024-11168: urlparse.urlsplit() did not validate the content of bracketed hosts, so domain names that are neither valid IPv6 nor IPvFuture literals were accepted inside "[" "]". A new _check_bracketed_host() is added (Lib/urlparse.py) and called from both the "http" fast-path and the generic branch of urlsplit(). Python 2.7 has no ipaddress module, so the bracket content is validated with socket.inet_pton() (IPv4 in brackets is rejected; otherwise the content must parse as IPv6). - CVE-2024-50602: a NULL pointer dereference in the bundled libexpat (Modules/expat/, 2.2.8) when XML_StopParser() was called on a parser in the XML_INITIALIZED state followed by XML_ResumeParser(). XML_StopParser() now refuses to stop/suspend an unstarted parser, returning the new XML_ERROR_NOT_STARTED. Backport of libexpat PR - CVE-2025-0938: completes CVE-2024-11168 by also rejecting square brackets in plain domain names. _check_bracketed_netloc() (Lib/urlparse.py) mirrors NetlocResultMixins._hostinfo() so data before/after the brackets is rejected; it replaces the inline bracket extraction in both branches of urlsplit().