URL validation bypass via bracketed-hostname parser confusion

Improper input validation in CPython urllib.parse allows remote attackers to trigger differential URL parsing with bracketed hostnames. urlsplit and urlparse extracted and validated only the text between embedded square brackets, accepting invalid prefix, suffix, or unmatched-bracket forms instead of rejecting the authority. Exploitation requires a consuming application to parse attacker-controlled URLs and trust the discrepant result, allowing hostname-based security decisions to diverge.