Vulnerability Report: GO-2025-3503
- CVE-2025-22870, GHSA-qxp5-gwg8-xv66
- Affects: net/http, golang.org/x/net
- Published: Mar 12, 2025
- Modified: Apr 16, 2026
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
Affected Packages
-
PathVersionsSymbols
-
before go1.23.7, from go1.24.0-0 before go1.24.1
-
before v0.36.0all symbols
-
before v0.36.0
Aliases
References
- https://go.dev/cl/654697
- https://go.dev/issue/71984
- https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ
- https://vuln.go.dev/ID/GO-2025-3503.json
Credits
- Juho Forsén of Mattermost
Feedback
See anything missing or incorrect?
Suggest an edit to this report.