CVE-2025-22870: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Deferred

AliasesSUSE-SU-2025:0802-1SUSE-SU-2025:0803-1SUSE-SU-2025:0866-1+3680 more

Published 12-03-2025Last modified 16-04-2026

Vulnerability summary

CVE-2025-22870 is a medium (CVSS 4.4) Misinterpretation of Input vulnerability in go standard library net/http. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.4, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.4/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.43%

0%100%

Low · +0.02 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 55 · Related 1055

MGASA-2025-0175 MGASA-2026-0147 OPENSUSE-SU-2025:14889-1 OPENSUSE-SU-2025:14909-1 OPENSUSE-SU-2025:14918-1 OPENSUSE-SU-2025:14988-1+94 more

Showing 100 of 1057.

Timeline

12-03-2025
PublishedVulnerability first disclosed.
16-04-2026
Last modifiedVulnerability information updated.

Description

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

CVSS metrics

8 scores · 8 sources · 1 version

v3.14.4

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

Increase +0.02 pp

From 0.40% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-115Misinterpretation of InputThe product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

aactl< 0.4.12-r28
actions-runner-controller< 0.10.1-r6
actions-runner-controller-compat< 0.10.1-r6
actions-runner-controller-fips< 0.10.1-r6
actions-runner-controller-fips-compat< 0.10.1-r6

addon-resizer< 1.8.23-r3
addon-resizer-compat< 1.8.23-r3
addon-resizer-fips< 1.8.23-r3
addon-resizer-fips-compat< 1.8.23-r3
agentbeat-fips< 8.17.3-r3
amazon-cloudwatch-agent< 1.300054.0-r1
amazon-cloudwatch-agent-all< 1.300054.0-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard< 1.300054.0-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300053.1-r1
amazon-cloudwatch-agent-compat< 1.300054.0-r1
amazon-cloudwatch-agent-config-downloader< 1.300054.0-r1
amazon-cloudwatch-agent-config-downloader-fips< 1.300053.1-r1
amazon-cloudwatch-agent-config-translator< 1.300054.0-r1
amazon-cloudwatch-agent-config-translator-fips< 1.300053.1-r1
amazon-cloudwatch-agent-fips< 1.300053.1-r1
amazon-cloudwatch-agent-operator< 2.2.0-r1
amazon-cloudwatch-agent-operator-compat< 2.2.0-r1
amazon-cloudwatch-agent-operator-fips< 2.2.0-r1
amazon-cloudwatch-agent-operator-fips-compat< 2.2.0-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent< 1.300054.0-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300053.1-r1
amazon-eks-ami< 20250304-r0
amazon-k8s-cni< 1.19.3-r2
amazon-k8s-cni-compat< 1.19.3-r2
amazon-k8s-cni-fips< 1.19.3-r3
amazon-k8s-cni-init< 1.19.3-r2
amazon-k8s-cni-init-compat< 1.19.3-r2
amazon-k8s-cni-init-fips< 1.19.3-r3
amazon-k8s-cni-init-fips-compat< 1.19.3-r3
amazon-ssm-agent< 3.3.1957.0-r4
amazon-ssm-agent-ecs-exec< 3.3.1957.0-r4
ansible-operator< 1.37.1-r5
ansible-operator-compat< 1.37.1-r5
apache-beam-java-11-sdk< 2.63.0-r1
apache-beam-java-17-sdk< 2.63.0-r1
apache-beam-java-21-sdk< 2.63.0-r1
apache-beam-java-sdk< 2.63.0-r1
apache-beam-python-3.11-sdk< 2.63.0-r2
apko< 0.25.5-r0
argo-cd-2.11< 2.11.13-r6
argo-cd-2.13< 2.13.5-r7
argo-cd-2.13-compat< 2.13.5-r7
argo-cd-2.13-repo-server< 2.13.5-r7
argo-cd-fips-2.14< 2.14.5-r2
argo-cd-fips-2.14-compat< 2.14.5-r2
argo-cd-fips-2.14-repo-server< 2.14.5-r2
argo-events< 1.9.5-r5
argo-events-fips< 1.9.5-r5
argo-rollouts< 1.8.0-r33
argo-rollouts-fips< 1.8.0-r5
argo-workflows< 3.6.5-r1
argo-workflows-fips< 3.6.5-r1
argocd-image-updater< 0.15.2-r8
argocd-image-updater-compat< 0.15.2-r8
atlantis< 0.33.0-r4
atlantis-fips< 0.33.0-r5
auditbeat-7< 7.17.28-r4
auditbeat-7-oci-entrypoint< 7.17.28-r4
auditbeat-fips-7< 7.17.28-r3
authservice-fips< 1.0.4-r4
authservice-fips-compat< 1.0.4-r4
aws-application-networking-k8s< 1.1.0-r5
aws-application-networking-k8s-compat< 1.1.0-r5
aws-ebs-csi-driver< 1.40.1-r1
aws-efs-csi-driver< 2.1.6-r2
aws-efs-csi-driver-fips< 2.1.6-r2
aws-iam-authenticator< 0.6.30-r2
aws-load-balancer-controller< 2.12.0-r1
aws-load-balancer-controller-compat< 2.12.0-r1
aws-load-balancer-controller-fips< 2.12.0-r1
aws-network-policy-agent< 1.2.0-r1
aws-network-policy-agent-compat< 1.2.0-r1
aws-network-policy-agent-compat-fips< 1.1.6-r4
aws-network-policy-agent-fips< 1.1.6-r4
aws-privateca-issuer-compat-fips< 1.4.1-r2
aws-privateca-issuer-fips< 1.4.1-r2
aws-s3-controller< 1.0.27-r32
azcopy< 10.28.0-r4
azcopy-fips< 10.28.0-r4
azure-aad-pod-identity-mic< 1.8.17-r20
azure-aad-pod-identity-nmi< 1.8.17-r20
azuredisk-csi-1.29< 1.29.12-r5
azuredisk-csi-1.29-compat< 1.29.12-r5
azuredisk-csi-1.30< 1.30.9-r3
azuredisk-csi-1.30-compat< 1.30.9-r3
azuredisk-csi-fips-1.28< 1.28.11-r9
azuredisk-csi-fips-1.29< 1.29.12-r5
azuredisk-csi-fips-1.30< 1.30.9-r3
bank-vaults< 1.20.4-r27
bank-vaults-fips< 1.20.4-r24
bank-vaults-template< 1.20.4-r27
bank-vaults-template-fips< 1.20.4-r24
beats-7< 7.17.28-r4
beats-fips-7< 7.17.28-r3
bom< 0.6.0-r18
boring-registry< 0.16.3-r1
boring-registry-fips< 0.16.3-r1
buildah< 1.39.2-r32
buildctl< 0.20.1-r2
buildctl-fips< 0.20.1-r2
buildkitd< 0.20.1-r2
buildkitd-fips< 0.20.1-r2
caddy< 2.9.1-r7
caddy-fips< 2.9.1-r7
caddy-man< 2.9.1-r7
caddy-src< 2.9.1-r7
cadvisor< 0.52.1-r3
cadvisor-compat< 0.52.1-r3
cadvisor-fips< 0.52.1-r2
calico-3.29< 3.29.2-r31
calico-apiserver-3.29< 3.29.2-r31
calico-apiserver-compat-3.29< 3.29.2-r31
calico-apiserver-fips-3.29< 3.29.2-r31
calico-app-policy-3.29< 3.29.2-r31
calico-app-policy-fips-3.29< 3.29.2-r31
calico-cni-3.29< 3.29.2-r31
calico-cni-compat-3.29< 3.29.2-r31
calico-cni-compat-fips-3.29< 3.29.2-r31
calico-cni-fips-3.29< 3.29.2-r31
calico-felix-3.29< 3.29.2-r31
calico-felix-fips-3.29< 3.29.2-r31
calico-fips-3.29< 3.29.2-r31
calico-key-cert-provisioner-3.29< 3.29.2-r31
calico-key-cert-provisioner-fips-3.29< 3.29.2-r31
calico-kube-controllers-3.29< 3.29.2-r31
calico-kube-controllers-fips-3.29< 3.29.2-r31
calico-node-3.29< 3.29.2-r31
calico-node-fips-3.29< 3.29.2-r31
calico-pod2daemon-3.29< 3.29.2-r31
calico-pod2daemon-fips-3.29< 3.29.2-r31
calico-pod2daemon-flexvol-compat-3.29< 3.29.2-r31
calico-typha-client-3.29< 3.29.2-r31
calico-typha-client-fips-3.29< 3.29.2-r31
calico-typhad-3.29< 3.29.2-r31
calico-typhad-fips-3.29< 3.29.2-r31
calicoctl-3.29< 3.29.2-r31
calicoctl-fips-3.29< 3.29.2-r31
cass-operator< 1.23.0-r5
cass-operator-compat< 1.23.0-r5
cass-operator-compat-fips< 1.23.0-r5
cass-operator-config< 1.23.0-r5
cass-operator-fips< 1.23.0-r5
cass-operator-fips-no-pvc-delete< 1.23.0-r5
cass-operator-fips-no-pvc-delete-compat< 1.23.0-r5
cert-exporter< 2.14.0-r9
cert-exporter-fips< 2.14.0-r9
cert-manager-cmctl< 2.1.1-r8
cert-manager-cmctl-fips< 2.1.1-r8
cert-manager-fips-1.17< 1.17.1-r4
cert-manager-istio-csr< 0.14.0-r6
cert-manager-istio-csr-compat< 0.14.0-r6
cert-manager-webhook-pdns< 2.5.2-r3
cert-manager-webhook-pdns-fips< 2.5.2-r3
certificate-transparency< 1.3.1-r5
certificate-transparency-fips< 1.3.1-r5
certificate-transparency-fips-trillian-ctserver< 1.3.1-r5
certificate-transparency-trillian-ctserver< 1.3.1-r5
cfssl< 1.6.5-r17
cfssl-bundle< 1.6.5-r17
cfssl-bundle-fips< 1.6.5-r9
cfssl-certinfo< 1.6.5-r17
cfssl-certinfo-fips< 1.6.5-r9
cfssl-fips< 1.6.5-r9
cfssl-json< 1.6.5-r17
cfssl-json-fips< 1.6.5-r9
cfssl-mkbundle< 1.6.5-r17
cfssl-mkbundle-fips< 1.6.5-r9
cfssl-multirootca< 1.6.5-r17
cfssl-multirootca-fips< 1.6.5-r9
cfssl-newkey< 1.6.5-r17
cfssl-newkey-fips< 1.6.5-r9
cfssl-scan< 1.6.5-r17
cfssl-scan-fips< 1.6.5-r9
chartmuseum< 0.16.2-r14
chartmuseum-fips< 0.16.2-r12
cilium-1.15< 1.15.14-r23
cilium-1.15-clustermesh-apiserver< 1.15.14-r23
cilium-1.15-container-init< 1.15.14-r23
cilium-1.15-container-init-compat< 1.15.14-r23
cilium-1.15-hubble-relay< 1.15.14-r23
cilium-1.15-iptables< 1.15.14-r23
cilium-1.15-operator-aws< 1.15.14-r23
cilium-1.15-operator-generic< 1.15.14-r23
cilium-1.16< 1.16.7-r23
cilium-1.16-clustermesh-apiserver< 1.16.7-r23
cilium-1.16-container-init< 1.16.7-r23
cilium-1.16-container-init-compat< 1.16.7-r23
cilium-1.16-hubble-relay< 1.16.7-r23
cilium-1.16-iptables< 1.16.7-r23
cilium-1.16-operator-aws< 1.16.7-r23
cilium-1.16-operator-generic< 1.16.7-r23
cilium-1.17< 1.17.1-r23
cilium-1.17-clustermesh-apiserver< 1.17.1-r23

Show all 198

Alpine2 products

go< 1.23.7-r0 | < 1.24.1-r0
rclone< 1.69.2-r0

2 vendors · 200 products · Showing 200 of 2690

References

33 links

Show all 33 references

www.suse.com/support/update/announcement/2025/suse-su-20250803-1/Advisory
bugzilla.suse.com/1229122REPORT
www.suse.com/support/update/announcement/2025/suse-su-20250866-1/Advisory
bugzilla.suse.com/1238702REPORT
www.suse.com/support/update/announcement/2025/suse-su-20250873-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-20251007-1/Advisory
bugzilla.suse.com/1238688REPORT
www.suse.com/support/update/announcement/2025/suse-su-20251055-1/Advisory
bugzilla.suse.com/1238685REPORT
ubuntu.com/security/CVE-2025-22870REPORT
www.cve.org/CVERecord?id=CVE-2025-22870REPORT
github.com/golang/go/issues/71984REPORT
ubuntu.com/security/notices/USN-7574-1Advisory
security-tracker.debian.org/tracker/CVE-2025-22870Advisory
nvd.nist.gov/vuln/detail/CVE-2025-22870AdvisoryOval
go-review.googlesource.com/q/project:netPACKAGE
security.netapp.com/advisory/ntap-20250509-0007WEB
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
security.alpinelinux.org/vuln/CVE-2025-22870Advisory