CVE-2025-22870

Published Mar 12, 2025

Last updated 4 months ago

Golang

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-22870 refers to a proxy bypass vulnerability found in Golang's `x/net/proxy` and `x/net/http/httpproxy` packages. This vulnerability allowed malicious actors to bypass configured proxies using IPv6 zone IDs. This issue affected various Golang versions prior to 1.24.1 and 1.23.7. The vulnerability has been addressed in subsequent releases, and users are encouraged to update their Golang installations to mitigate the risk.

Description: Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
Source: security@golang.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 4.4
Impact score: 2.5
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Severity: MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-115

Hype score: Not currently trending

References