CVE-2025-22870
HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
MEDIUM 4.4EPSS 0.4%
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
- Affected
- Go standard library · golang.org/x/net · net/http · golang.org/x/net/http/httpproxy · golang.org/x/net/proxy
- CVSS v3.1 CNA
- 4.4 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - EPSS
- 0.43% chance of exploitation in the next 30 days, 35th percentile
- Published
- 2025-03-12
- Updated
- 2026-04-16
Proof-of-concept exploits (1)
- JoshuaProvoste/CVE-2025-228702★ · 2025-06-08