Repository navigation
net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs #71984
Description
Matching of hosts against proxy patterns could improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable was set to "*.example.com", a request to "[::1%25.example.com]:80` would incorrectly match and not be proxied.
Thanks to Juho Forsén of Mattermost for reporting this issue.
This is CVE-2025-22870
/cc @golang/security and @golang/release
Activity
neild commentedon Feb 26, 2025
@gopherbot please open backport issues for this security fix
gopherbot commentedon Feb 26, 2025
Backport issue(s) opened: #71985 (for 1.23), #71986 (for 1.24).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
[-]security: fix CVE-2025-22870[/-][+]net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs[/+]gopherbot commentedon Mar 4, 2025
Change https://go.dev/cl/654717 mentions this issue:
all: update golang.org/x/netgopherbot commentedon Mar 4, 2025
Change https://go.dev/cl/654795 mentions this issue:
[release-branch.go1.24] all: updates vendored x/netgopherbot commentedon Mar 4, 2025
Change https://go.dev/cl/654796 mentions this issue:
[release-branch.go1.23] all: updates vendored x/net[release-branch.go1.24] all: updates vendored x/net
[release-branch.go1.23] all: updates vendored x/net
all: update golang.org/x/net
fix(deps): update golang.org/x/net
fix(deps): update golang.org/x/net
fix(deps): update golang.org/x/net (#188)
proxy, http/httpproxy: do not mismatch IPv6 zone ids against hosts
CVE-2025-22870: vendor: proxy, http/httpproxy: do not mismatch IPv6 z…
- Latest versions for deps
[release-branch.go1.24] all: updates vendored x/net