CVE-2025-22870
Vulnerability Summary
Timeline
Description
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
CVSS Metrics
- v3.1•MEDIUM•Score: 4.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
EPSS Trends
Current EPSS score: 0.40%• Percentile: 34%
Techniques & Countermeasures
- CWE-115•Misinterpretation of Input
The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
Affected Systems
- chainguard•aactl
< 0.4.12-r28
- chainguard•actions-runner-controller
< 0.10.1-r6
- chainguard•actions-runner-controller-compat
< 0.10.1-r6
- chainguard•actions-runner-controller-fips
< 0.10.1-r6
- chainguard•actions-runner-controller-fips-compat
< 0.10.1-r6
- chainguard•addon-resizer
< 1.8.23-r3
- chainguard•addon-resizer-compat
< 1.8.23-r3
- chainguard•addon-resizer-fips
< 1.8.23-r3
- chainguard•addon-resizer-fips-compat
< 1.8.23-r3
- chainguard•agentbeat-fips
< 8.17.3-r3
- chainguard•amazon-cloudwatch-agent
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-all
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips
< 1.300053.1-r1
- chainguard•amazon-cloudwatch-agent-compat
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-config-downloader
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-config-downloader-fips
< 1.300053.1-r1
- chainguard•amazon-cloudwatch-agent-config-translator
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-config-translator-fips
< 1.300053.1-r1
- chainguard•amazon-cloudwatch-agent-fips
< 1.300053.1-r1
- chainguard•amazon-cloudwatch-agent-operator
< 2.2.0-r1
- chainguard•amazon-cloudwatch-agent-operator-compat
< 2.2.0-r1
- chainguard•amazon-cloudwatch-agent-operator-fips
< 2.2.0-r1
- chainguard•amazon-cloudwatch-agent-operator-fips-compat
< 2.2.0-r1
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent
< 1.300054.0-r1
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips
< 1.300053.1-r1
- chainguard•amazon-eks-ami
< 20250304-r0
- chainguard•amazon-k8s-cni
< 1.19.3-r2
- chainguard•amazon-k8s-cni-compat
< 1.19.3-r2
- chainguard•amazon-k8s-cni-fips
< 1.19.3-r3
- chainguard•amazon-k8s-cni-init
< 1.19.3-r2
- chainguard•amazon-k8s-cni-init-compat
< 1.19.3-r2
- chainguard•amazon-k8s-cni-init-fips
< 1.19.3-r3
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.19.3-r3
- chainguard•amazon-ssm-agent
< 3.3.1957.0-r4
- chainguard•amazon-ssm-agent-ecs-exec
< 3.3.1957.0-r4
- chainguard•ansible-operator
< 1.37.1-r5
- chainguard•ansible-operator-compat
< 1.37.1-r5
- chainguard•apache-beam-java-11-sdk
< 2.63.0-r1
- chainguard•apache-beam-java-17-sdk
< 2.63.0-r1
- chainguard•apache-beam-java-21-sdk
< 2.63.0-r1
- chainguard•apache-beam-java-sdk
< 2.63.0-r1
- chainguard•apache-beam-python-3.11-sdk
< 2.63.0-r2
- chainguard•apko
< 0.25.5-r0
- chainguard•argo-cd-2.11
< 2.11.13-r6
- chainguard•argo-cd-2.13
< 2.13.5-r7
- chainguard•argo-cd-2.13-compat
< 2.13.5-r7
- chainguard•argo-cd-2.13-repo-server
< 2.13.5-r7
- chainguard•argo-cd-fips-2.14
< 2.14.5-r2
- chainguard•argo-cd-fips-2.14-compat
< 2.14.5-r2
Showing first 50 affected entries in server-rendered view.
References (10)
- https://go.dev/cl/654697
- https://go.dev/issue/71984
- https://pkg.go.dev/vuln/GO-2025-3503
- http://www.openwall.com/lists/oss-security/2025/03/07/2
- https://security.netapp.com/advisory/ntap-20250509-0007/
- https://nvd.nist.gov/vuln/detail/CVE-2025-22870
- https://go-review.googlesource.com/q/project:net
- https://security.netapp.com/advisory/ntap-20250509-0007
- https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ
- https://security-tracker.debian.org/tracker/CVE-2025-22870