CVE-2025-22870
MEDIUMgolang.org/x/net < 0.36.0 and Go net/http < 1.23.7/1.24.0-1.24.1 - Proxy Bypass via IPv6 Zone ID Misinterpretation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-22870. PoCs published by JoshuaProvoste.
AI-analyzed exploit summary This PoC demonstrates CVE-2025-22870, a vulnerability in the `golang.org/x/net/http/httpproxy` package that allows bypassing HTTP proxy restrictions by exploiting IPv6 zone ID parsing flaws in NO_PROXY matching. The exploit sends a crafted request to `[::1%25.example.com]:7777`, which incorrectly matches NO_PROXY rules and evades proxy routing.
Description
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
Exploits (1)
This PoC demonstrates CVE-2025-22870, a vulnerability in the `golang.org/x/net/http/httpproxy` package that allows bypassing HTTP proxy restrictions by exploiting IPv6 zone ID parsing flaws in NO_PROXY matching. The exploit sends a crafted request to `[::1%25.example.com]:7777`, which incorrectly matches NO_PROXY rules and evades proxy routing.
References (6)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L