CVE-2025-22870
MEDIUMProxy Pattern - Info Disclosure
Title source: llmDescription
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
Exploits (1)
nomisec
WORKING POC
2 stars
by JoshuaProvoste · poc
https://github.com/JoshuaProvoste/CVE-2025-22870
References (6)
Scores
CVSS v3
4.4
EPSS
0.0002
EPSS Percentile
6.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Details
CWE
CWE-115
Status
published
Products (5)
golang.org/x/net/golang.org/x/net/http/httpproxy
< 0.36.0
golang.org/x/net/golang.org/x/net/proxy
< 0.36.0
Go standard library/net/http
< 1.23.7
Go standard library/net/http
1.24.0-0 - 1.24.1
x/net
0 - 0.36.0Go
Published
Mar 12, 2025
Tracked Since
Feb 18, 2026