diff --git a/src/commons/masking.py b/src/commons/masking.py
index 3d8b292..dd69622 100644
--- a/src/commons/masking.py
+++ b/src/commons/masking.py
@@ -73,9 +73,14 @@ def mask_url(url: str) -> str:
 
     does NOT parse or hunt for sensitive params - it simply drops everything after the
     path, so it structurally cannot leak a query param and cannot over-mask a legit one.
-    a url with no query/fragment is returned unchanged.
+    a url with no query/fragment is returned unchanged; a url urlsplit cannot parse
+    (a malformed ipv6 literal) is also returned unchanged rather than crashing the
+    display/log call this feeds.
     """
-    parts = urlsplit(url)
+    try:
+        parts = urlsplit(url)
+    except ValueError:
+        return url
     return urlunsplit((parts.scheme, parts.netloc, parts.path, "", ""))