Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
History

Tue, 18 Mar 2025 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-115
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 14 Mar 2025 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
References
Metrics threat_severity

None

cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L'}

threat_severity

Moderate


Wed, 12 Mar 2025 19:45:00 +0000

Type Values Removed Values Added
References

Wed, 12 Mar 2025 18:45:00 +0000

Type Values Removed Values Added
Description Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
Title HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
References

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2025-03-18T16:32:14.847Z

Reserved: 2025-01-08T19:11:42.834Z

Link: CVE-2025-22870

cve-icon Vulnrichment

Updated: 2025-03-12T19:02:51.191Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-03-12T19:15:38.310

Modified: 2025-03-18T17:15:45.467

Link: CVE-2025-22870

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-03-12T18:27:59Z

Links: CVE-2025-22870 - Bugzilla