CVE-2025-22870 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
Attackers can bypass HTTP proxy restrictions by using IPv6 zone IDs in hostnames, potentially exposing internal services or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-22870?
CVE-2025-22870 is a medium-severity vulnerability in golang.org/x/net/http/httpproxy, published on 12 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
Weakness: CWE-115
Which versions are affected by CVE-2025-22870?
4 open source packages ship an affected version, including golang.org/x/net and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/net Go | All versions | 0.36.0 |
golang.org/x/net Go | All versions | 0.36.0 |
golang.org/x/net Go | All versions | 0.36.0 |
stdlib Go | All versions | 1.23.7, 1.24.1 |
Linux distribution packages (24)
helm SUSE:Linux Enterprise Micro 5.5 | All versions | 3.17.2-150000.1.44.1 |
skopeo SUSE:Linux Enterprise Micro 5.5 | All versions | 1.14.4-150300.11.22.1 |
skopeo SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 1.14.4-150300.11.22.1 |
helm SUSE:Linux Enterprise Module for Containers 15 SP6 | All versions | 3.17.2-150000.1.44.1 |
go1.23 SUSE:Linux Enterprise Module for Development Tools 15 SP6 | All versions | 1.23.7-150000.1.24.1 |
go1.24 SUSE:Linux Enterprise Module for Development Tools 15 SP6 | All versions | 1.24.1-150000.1.12.1 |
helm SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 3.17.2-150000.1.44.1 |
amazon-ssm-agent SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 3.3.1611.0-4.39.1 |
amazon-ssm-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP3 | All versions | 3.3.1611.0-150000.5.23.1 |
amazon-ssm-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.3.1611.0-150000.5.23.1 |
amazon-ssm-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 3.3.1611.0-150000.5.23.1 |
amazon-ssm-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | All versions | 3.3.1611.0-150000.5.23.1 |
amazon-ssm-agent openSUSE:Leap 15.6 | All versions | 3.3.1611.0-150000.5.23.1 |
go1.23 openSUSE:Leap 15.6 | All versions | 1.23.7-150000.1.24.1 |
go1.24 openSUSE:Leap 15.6 | All versions | 1.24.1-150000.1.12.1 |
helm openSUSE:Leap 15.6 | All versions | 3.17.2-150000.1.44.1 |
skopeo openSUSE:Leap 15.6 | All versions | 1.14.4-150300.11.22.1 |
amazon-ssm-agent openSUSE:Tumbleweed | All versions | 3.3.1957.0-2.1 |
go1.23 openSUSE:Tumbleweed | All versions | 1.23.7-1.1 |
go1.24 openSUSE:Tumbleweed | All versions | 1.24.1-1.1 |
golang-github-prometheus-alertmanager openSUSE:Tumbleweed | All versions | 0.28.1-2.1 |
golang-github-prometheus-node_exporter openSUSE:Tumbleweed | All versions | 1.9.1-2.1 |
helm openSUSE:Tumbleweed | All versions | 3.17.2-1.1 |
teleport openSUSE:Tumbleweed | All versions | 17.3.3-1.1 |
How do I fix CVE-2025-22870?
Upgrade golang.org/x/net to 0.36.0 or later.
Is CVE-2025-22870 being exploited?
There is no known exploitation of CVE-2025-22870 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as AZL-58380, AZL-58386, AZL-58392, AZL-58396, AZL-58402, AZL-58404 and 192 more.