Vulnerability Report: GO-2025-3503

standard library

CVE-2025-22870, GHSA-qxp5-gwg8-xv66
Affects: net/http, golang.org/x/net
Published: Mar 12, 2025
Modified: Apr 16, 2026

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Affected Packages

Path

Go Versions

Symbols
net/http

before go1.23.7, from go1.24.0-0 before go1.24.1
- ProxyFromEnvironment
golang.org/x/net/http/httpproxy

before v0.36.0
2 unexported affected symbols
- config.useProxy
- domainMatch.match
golang.org/x/net/proxy

before v0.36.0
6 affected symbols

Aliases

CVE-2025-22870
GHSA-qxp5-gwg8-xv66

References

https://go.dev/cl/654697
https://go.dev/issue/71984
https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ
https://vuln.go.dev/ID/GO-2025-3503.json

Credits

Juho Forsén of Mattermost

Feedback

See anything missing or incorrect? Suggest an edit to this report.