CVE-2025-22870

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Published Mar 12, 2025 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Description
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-6690 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
Github GHSA Github GHSA GHSA-qxp5-gwg8-xv66 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
Ubuntu USN Ubuntu USN USN-7574-1 Go vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00012}

epss

{'score': 0.00014}

Type Values Removed Values Added
First Time appeared Redhat
Redhat openshift Data Foundation
CPEs cpe:/a:redhat:openshift_data_foundation:4.18::el9
Vendors & Products Redhat
Redhat openshift Data Foundation
Type Values Removed Values Added
Weaknesses CWE-115
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Weaknesses CWE-20
References
Metrics threat_severity

None

cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L'}

threat_severity

Moderate

Type Values Removed Values Added
Description Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
Title HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Apr 16, 2026, 10:39 PM
Reserved
Jan 8, 2025, 7:11 PM
Status
Deferred
Published
Mar 12, 2025, 7:15 PM
Modified
Jun 17, 2026, 8:50 AM
Severity
Moderate
Public date
Mar 12, 2025, 6:27 PM