MGASA-2025-0175

Advisory lineage Upstream: 2 Downstream: 0
Published: 02 Jun 2025, 17:55
Last modified:16 Apr 2026, 04:20

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

02 Jun 2025, 17:55
Published
Vulnerability first disclosed
16 Apr 2026, 04:20
Last Modified
Vulnerability information updated

Description

Updated golang packages fix security vulnerabilities Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied - CVE-2025-22870. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext - CVE-2025-22871.

Affected Systems

  • mageia•golang

    < 1.23.8-1.mga9

References (5)