# CVE-2025-22870: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Source: https://junglewise.ai/threats/cve-2025-22870-http-proxy-bypass-using-ipv6-zone-ids-in-golang-org-x-net  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-03-12. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2025-22870 · Severity: medium · CVSS 4.4 · Published 2025-03-12

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Technologies: [golang.org/x/net (Go)](https://junglewise.ai/threats/technologies/golang-org-x-net), [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2025-22870 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-22870 being exploited in the wild.

**How severe is CVE-2025-22870?** Medium severity, with a CVSS score of 4.4, published 12 March 2025.

**Which products and versions are affected?** golang.org/x/net (Go) < 0.36.0, SEMVER:introduced=0,fixed=0.36.0; stdlib (Go) SEMVER:introduced=0,fixed=1.23.7,introduced=1.24.0-0,fixed=1.24.1.

**Is there a fix for CVE-2025-22870?** Yes. golang.org/x/net (Go): upgrade to 0.36.0 or later; stdlib (Go): upgrade to 1.24.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-22870?** Check whether you run golang.org/x/net (Go) or stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- golang.org/x/net (Go): upgrade to 0.36.0 or later

  ```sh
  go get golang.org/x/net@v0.36.0
  ```

- stdlib (Go): upgrade to 1.24.1 or later

  ```sh
  go get stdlib@v1.24.1
  ```


## Affected products

- golang.org/x/net (Go) < 0.36.0, SEMVER:introduced=0,fixed=0.36.0
- stdlib (Go) SEMVER:introduced=0,fixed=1.23.7,introduced=1.24.0-0,fixed=1.24.1

## Identifiers

- CVE-2025-22870
- GHSA-qxp5-gwg8-xv66
- GO-2025-3503

## References

- [https://go.dev/cl/654697](https://go.dev/cl/654697)
- [https://go.dev/issue/71984](https://go.dev/issue/71984)
- [https://pkg.go.dev/vuln/GO-2025-3503](https://pkg.go.dev/vuln/GO-2025-3503)
- [http://www.openwall.com/lists/oss-security/2025/03/07/2](http://www.openwall.com/lists/oss-security/2025/03/07/2)
- [https://security.netapp.com/advisory/ntap-20250509-0007](https://security.netapp.com/advisory/ntap-20250509-0007)

## Related threats

- [Go HTTP/1 server race condition in MaxBytesReader header handling](https://junglewise.ai/threats/cve-2026-97054-for-http-1-servers-when-maxbytesreader-s-limit-is-exceeded)
- [Go html parser namespace handling in childTextNodesAreLiteral](https://junglewise.ai/threats/cve-2026-97045-in-childtextnodesareliteral-walking-up-the-tree-previously)
- [Go HTML parser quadratic time complexity in text node coalescing](https://junglewise.ai/threats/cve-2026-78661-when-coalescing-adjacent-text-nodes-in-addtext-and-fosterparent)
- [Go crypto/x509 untrusted intermediate certificate validation](https://junglewise.ai/threats/cve-2026-111943-on-most-platforms-go-uses-the-given-system-root-certificates)
- [Go crypto/tls malformed ECH extension DoS](https://junglewise.ai/threats/cve-2026-97031-go-2026-6607-reject-malformed-ech-outer-extension-references-in)