CVE-2025-22870mediumCWE-115

CVE-2025-22870: falha de média gravidade em golang.org/x/net/http/httpproxy

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar net/http+ Monitorar golang.org/x/net/http/httpproxy

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.4epss 0.4%
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Produtos afetados
golang.org/x/net · golang.org/x/net/http/httpproxygolang.org/x/net · golang.org/x/net/proxyGo standard library · net/http
CVEs relacionadas — golang.org/x/net/http/httpproxy

No mesmo produto, das mais perigosas para as menos.

CVE-2023-45288HIGHHTTP/2 CONTINUATION flood in net/httpEPSS 89.5%CVE-2022-41717—Excessive memory growth in net/http and golang.org/x/net/http2EPSS 6.1%CVE-2022-41723HIGHDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/netEPSS 4.6%CVE-2023-39325—HTTP/2 rapid reset can cause excessive work in net/httpEPSS 3.8%CVE-2026-39821CRITICALInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaEPSS 1.8%CVE-2022-1705MEDIUMImproper sanitization of Transfer-Encoding headers in net/httpEPSS 1.5%