Vulnerability Report: GO-2025-3503

CVE-2025-22870
Affects: golang.org/x/net
Published: Mar 12, 2025

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Affected Packages

Path

Go Versions

Symbols
golang.org/x/net/http/httpproxy

before v0.36.0
2 unexported affected symbols
- config.useProxy
- domainMatch.match
golang.org/x/net/proxy

before v0.36.0
6 affected symbols

Aliases

CVE-2025-22870

References

https://go.dev/cl/654697
https://go.dev/issue/71984
https://vuln.go.dev/ID/GO-2025-3503.json

Credits

Juho Forsén of Mattermost

Feedback

See anything missing or incorrect? Suggest an edit to this report.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL