CVE-2025-22870

Aliases:GHSA-qxp5-gwg8-xv66GO-2025-3503
Advisory lineage Upstream: 0 Downstream: 54
Deferred
Published: 12 Mar 2025, 18:27
Last modified:16 Apr 2026, 22:39

Vulnerability Summary

Overall Risk (default)
low
18/100
CVSS Score
4.4 MEDIUM
v3.1 (cve.org)
EPSS Score
0.02% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Mar 2025, 18:27
Published
Vulnerability first disclosed
16 Apr 2026, 22:39
Last Modified
Vulnerability information updated

Description

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

EPSS Trends

Current EPSS score: 0.02%• Percentile: 7%

Techniques & Countermeasures

  • CWE-115•Misinterpretation of Input

    The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.

Affected Systems

  • go standard library•net/http

    < 1.23.7 | ≥ 1.24.0-0, < 1.24.1

  • golang.org/x•net

    < 0.36.0

  • Go•stdlib

    ≥ 1.24.0-0, < 1.24.1

  • golang.org/x/net•golang.org/x/net/http/httpproxy

    < 0.36.0

  • golang.org/x/net•golang.org/x/net/proxy

    < 0.36.0

References (9)