Log in Start free

Vulnerability · Published Mar 12, 2025 · Assigned by Go

CVE-2025-22870HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Medium 4.4

In plain English

A medium-severity security flaw in net/http from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.4%top 63.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21go1.23.7-r0ALPINE-CVE-2025-22870
Alpine:v3.22go1.24.1-r0ALPINE-CVE-2025-22870
Alpine:v3.23go1.24.1-r0ALPINE-CVE-2025-22870
Alpine:v3.24go1.24.1-r0ALPINE-CVE-2025-22870
Alpine:v3.22rclone1.69.2-r0ALPINE-CVE-2025-22870
Alpine:v3.23rclone1.69.2-r0ALPINE-CVE-2025-22870
Alpine:v3.24rclone1.69.2-r0ALPINE-CVE-2025-22870
Debian:12golang-1.19no fix listedDEBIAN-CVE-2025-22870
Debian:13golang-1.241.24.1-1DEBIAN-CVE-2025-22870
Gogolang.org/x/net0.36.0GO-2025-3503
Gogolang.org/x/net0.36.0GHSA-qxp5-gwg8-xv66
Gostdlib1.23.7, 1.24.1GO-2025-3503
Ubuntu:22.04:LTSgolang-1.17no fix listedUBUNTU-CVE-2025-22870
Ubuntu:22.04:LTSgolang-1.18no fix listedUBUNTU-CVE-2025-22870
Ubuntu:22.04:LTSgolang-1.20no fix listedUBUNTU-CVE-2025-22870
Ubuntu:22.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2025-22870
Ubuntu:24.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2025-22870
Ubuntu:22.04:LTSgolang-1.221.22.2-2~22.04.3USN-7574-1
Ubuntu:22.04:LTSgolang-1.221.22.2-2~22.04.3UBUNTU-CVE-2025-22870
Ubuntu:24.04:LTSgolang-1.221.22.2-2ubuntu0.4UBUNTU-CVE-2025-22870
Ubuntu:24.04:LTSgolang-1.221.22.2-2ubuntu0.4USN-7574-1
Ubuntu:22.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2025-22870
Ubuntu:24.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2025-22870
Ubuntu:25.10golang-1.23no fix listedUBUNTU-CVE-2025-22870
Ubuntu:26.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2025-22870
Ubuntu:22.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2025-22870
Ubuntu:24.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2025-22870
Ubuntu:25.10golang-1.24no fix listedUBUNTU-CVE-2025-22870
Ubuntu:26.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2025-22870

Affected products (as reported)

VendorProductVersions
Go standard library net/http 0 – before 1.23.71.24.0-0 – before 1.24.1
golang.org/x/net golang.org/x/net/http/httpproxy 0 – before 0.36.0
golang.org/x/net golang.org/x/net/proxy 0 – before 0.36.0

Weakness: CWE-115 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References