HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Go standard library | net/http | unaffected |
|
|||||||||
| golang.org/x/net | golang.org/x/net/http/httpproxy | unaffected |
|
|||||||||
| golang.org/x/net | golang.org/x/net/proxy | unaffected |
|
No data.
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| RHODF-4.18-RHEL-9 | |||
| odf4/cephcsi-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/cephcsi-rhel9:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/cephcsi-rhel9-operator:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/mcg-core-rhel9:v4.18.3-3 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/mcg-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/mcg-rhel9-operator:v4.18.3-3 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/ocs-client-console-rhel9:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/ocs-client-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/ocs-client-rhel9-operator:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/ocs-metrics-exporter-rhel9:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/ocs-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/ocs-rhel9-operator:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-cli-rhel9:v4.18.3-3 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-console-rhel9:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-cosi-sidecar-rhel9:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-csi-addons-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-csi-addons-rhel9-operator:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-csi-addons-sidecar-rhel9:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-dependencies-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-multicluster-console-rhel9:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-multicluster-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-multicluster-rhel9-operator:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-must-gather-rhel9:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-prometheus-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odf-rhel9-operator:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odr-cluster-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odr-hub-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odr-recipe-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/odr-rhel9-operator:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/rook-ceph-operator-bundle:v4.18.3-4 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
| odf4/rook-ceph-rhel9-operator:v4.18.3-2 | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | RHSA-2025:7616 | 2025-05-14T00:00:00Z |
No data available yet.
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2025-6690 | HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net |
Github GHSA |
GHSA-qxp5-gwg8-xv66 | HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net |
Ubuntu USN |
USN-7574-1 | Go vulnerabilities |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.425% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat
Redhat openshift Data Foundation |
|
| CPEs | cpe:/a:redhat:openshift_data_foundation:4.18::el9 | |
| Vendors & Products |
Redhat
Redhat openshift Data Foundation |
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-115 | |
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-20 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied. | |
| Title | HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net | |
| References |
|