The urllib.parse.urlsplit() and urlparse() functions in Python improperly validated bracketed hosts, allowing hosts that were not valid IPv6 or IPvFuture addresses. This non-conformance with RFC 3986 could potentially enable server-side request forgery (SSRF) if a URL is processed by multiple URL parsers.