diff --git a/Misc/NEWS b/Misc/NEWS index 47f3c379049b8f..081d51db8c7aaa 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -366,7 +366,7 @@ Library ------- - [Security] bpo-30500: Fix urllib.parse.splithost() to correctly parse - fragments. For example, ``splithost('http://127.0.0.1#@evil.com/')`` now + fragments. For example, ``splithost('//127.0.0.1#@evil.com/')`` now correctly returns the ``127.0.0.1`` host, instead of treating ``@evil.com`` as the host in an authentification (``login@host``).