CVE-2025-22870: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Published Mar 7, 2025
·
Updated

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Other sources

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "[::1%25.example.com]:80 will incorrectly match and not be proxied.

NVD

Affected Software

32 affected componentsFixes available
Google golang.org/x/net
go/golang.org/x/net<0.36.0
0.36.0
IBM Concert Software<=1.0.0-2.1.0
Microsoft azl3 packer 1.9.5-9<1.9.5-8
1.9.5-8
Microsoft azl3 keda 2.14.1-7<2.14.1-6
2.14.1-6
Microsoft cbl2 keda 2.4.0-29<2.4.0-29
2.4.0-29
Microsoft cbl2 telegraf 1.29.4-16<1.29.4-14
1.29.4-14
Microsoft cbl2 git-lfs 3.5.1-5<3.5.1-5
3.5.1-5
Microsoft azl3 telegraf 1.31.0-6<1.31.0-6
1.31.0-6
Microsoft azl3 influxdb 2.7.5-3<2.7.5-3
2.7.5-3
Microsoft azl3 prometheus-process-exporter 0.8.2-2<0.8.2-2
0.8.2-2
Microsoft cbl2 vitess 17.0.7-8<17.0.7-7
17.0.7-7
Microsoft azl3 influxdb 2.7.5-5<2.7.5-3
2.7.5-3
Microsoft azl3 prometheus-node-exporter 1.7.0-3<1.7.0-3
1.7.0-3
Microsoft azl3 vitess 19.0.4-6<19.0.4-6
19.0.4-6
Microsoft azl3 git-lfs 3.6.1-2<3.6.1-2
3.6.1-2
Microsoft azl3 keda 2.14.1-6<2.14.1-6
2.14.1-6
Microsoft azl3 packer 1.9.5-8<1.9.5-8
1.9.5-8
Microsoft azl3 azcopy 10.25.1-4<10.25.1-4
10.25.1-4
Microsoft azl3 prometheus 2.45.4-12<2.45.4-12
2.45.4-12
Microsoft cbl2 packer 1.9.5-11<1.9.5-11
1.9.5-11
Microsoft cbl2 telegraf 1.29.4-14<1.29.4-14
1.29.4-14
Microsoft cbl2 azcopy 10.25.1-4<10.25.1-4
10.25.1-4
Microsoft cbl2 golang 1.18.8-8<1.18.8-8
1.18.8-8
Microsoft cbl2 vitess 17.0.7-7<17.0.7-7
17.0.7-7
Microsoft cbl2 azcopy 10.25.1-5<10.25.1-4
10.25.1-4
Microsoft cbl2 packer 1.9.5-13<1.9.5-11
1.9.5-11
Microsoft azl3 vitess 19.0.4-7<19.0.4-6
19.0.4-6
Microsoft azl3 telegraf 1.31.0-10<1.31.0-6
1.31.0-6
Microsoft cbl2 golang 1.22.7-4<1.22.7-4
1.22.7-4
Microsoft cbl2 influxdb 2.6.1-22<2.6.1-22
2.6.1-22
Microsoft cbl2 blobfuse2 2.1.2-8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade go/golang.org/x/net to a version that resolves this vulnerability.

    Fixed in 0.36.0
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.9.5-8
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.4.0-29
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.29.4-14
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.14.1-6
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.5.1-5
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.31.0-6
  8. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.7.5-3
  9. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 17.0.7-7
  10. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 0.8.2-2
  11. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.7.0-3
  12. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 19.0.4-6
  13. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.6.1-2
  14. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.25.1-4
  15. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.45.4-12
  16. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.9.5-11
  17. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.18.8-8
  18. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.22.7-4
  19. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.6.1-22

Event History

Mar 12, 2025
CVE Published
via MITRE·06:27 PM
Data Sourced
via MITRE·06:27 PM
DescriptionWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Data Sourced
via Red Hat·09:41 PM
DescriptionSeverityAffected Software
Advisory Published
via GitHub·10:06 PM
Mar 27, 2025
Data Sourced
via Microsoft·12:00 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·07:00 AM
Description
Updated
via Microsoft·07:00 AM
SeverityAffected Software
Jan 21, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-22870?

CVE-2025-22870 is classified as a moderate severity vulnerability due to improper handling of IPv6 zone IDs in proxy pattern matching.

2

How do I fix CVE-2025-22870?

To fix CVE-2025-22870, update to the latest version of the golang.org/x/net package where the issue has been addressed.

3

What types of systems are affected by CVE-2025-22870?

CVE-2025-22870 affects systems using the Golang library, specifically those making use of proxy settings with IPv6 addresses.

4

What kind of attacks can occur due to CVE-2025-22870?

Exploitation of CVE-2025-22870 could lead to sensitive information being leaked or improper access control in applications that rely on proxy configurations.

5

Is it safe to use the NO_PROXY environment variable with CVE-2025-22870?

Using the NO_PROXY environment variable in environments affected by CVE-2025-22870 can lead to unintended behavior, making it unsafe until the vulnerability is mitigated.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203