HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
Priority LOW 21CWE-115Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Partial Red Hat: 5 fixed, 52 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 37th percentileScored 2026-11-07
Fix Partial net/http (Go standard library): 1.23.7, 1.24.1golang.org/x/net/http/httpproxy (golang.org/x/net): 0.36.0+2 more productsRed Hat: 5 advisoriesRed Hat: 5 fixed, 52 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | net/http | before 1.23.7; 1.24.0-0 to before 1.24.1 | 1.23.7, 1.24.1 | Patch available | CNA |
| Go standard library | golang.org/x/net/http/httpproxy | before 0.36.0 | 0.36.0 | Patch available | CNA |
| Go standard library | golang.org/x/net/proxy | before 0.36.0 | 0.36.0 | Patch available | CNA |
| — | golang.org/x/net (Go) | before 0.36.0 | 0.36.0 | Patch available | GHSA-qxp5-gwg8-xv66 |
- net/http VendorGo standard library Affected before 1.23.7; 1.24.0-0 to before 1.24.1 Fixed in 1.23.7, 1.24.1 Patch available CNA
- golang.org/x/net/http/httpproxy VendorGo standard library Affected before 0.36.0 Fixed in 0.36.0 Patch available CNA
- golang.org/x/net/proxy VendorGo standard library Affected before 0.36.0 Fixed in 0.36.0 Patch available CNA
- golang.org/x/net (Go) Vendor— Affected before 0.36.0 Fixed in 0.36.0 Patch available GHSA-qxp5-gwg8-xv66
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | — | — | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions — — ·Go standard library
Remediation
- Fix · CNA net/http (Go standard library) Fixed in 1.23.7, 1.24.1
- Fix · CNA golang.org/x/net/http/httpproxy (golang.org/x/net) Fixed in 0.36.0
- Fix · CNA golang.org/x/net/proxy (golang.org/x/net) Fixed in 0.36.0
- Fix · GHSA-qxp5-gwg8-xv66 golang.org/x/net (Go) Fixed in 0.36.0 Advisory →
Red Hat 5 advisories
- RHSA-2026:37387 Released 2026-07-09 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
- RHSA-2026:34342 Released 2026-07-01 · Red Hat rating CriticalCluster Observability Operator 1.5.0
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9
- RHSA-2026:6503 Released 2026-04-02 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.20.9 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
Show 2 more Red Hat advisories
- RHSA-2025:14090 Released 2025-08-19 · Red Hat rating ImportantRed Hat Developer Hub 1.7.0 release.
- Red Hat Developer Hub 1.7 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2025:7616 Released 2025-05-14 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.3 Bug Fix Update
- RHODF 4.18 for RHEL 9 odf4/cephcsi-operator-bundle, odf4/cephcsi-rhel9, odf4/cephcsi-rhel9-operator +29
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix yet: Fix deferred |
| Builds for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Cryostat 3 | Affected | No fix yet: Fix deferred |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Fence Agents Remediation Operator | Affected | No fix yet: Fix deferred |
| Kube Descheduler Operator | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 7 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| NBDE Tang Server | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| Node Maintenance Operator | Affected | No fix yet: Fix deferred |
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2 | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 5 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix yet |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager preview | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift on AWS | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Self Node Remediation Operator | Affected | No fix yet: Fix deferred |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:34342 |
| RHODF 4.18 for RHEL 9 | Fixed | RHSA-2025:7616 |
| Red Hat Developer Hub 1.7 | Fixed | RHSA-2025:14090 |
| Red Hat Openshift Data Foundation 4.20 | Fixed | RHSA-2026:6503 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:37387 |
Not affected: 4 products
- Cluster Observability Operator 1.5
- Red Hat Developer Hub 1.7
- Red Hat Openshift Data Foundation 4.20
- Red Hat Openshift Data Foundation 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2025-22870
- 2026-10-03 Alias added: GHSA-qxp5-gwg8-xv66
- 2026-10-27 Affected versions changed · Red Hat
- 2026-11-04 Fix available: RHSA-2025:7616 · Red Hat
- 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat
References
Other 7
- https://go.dev/cl/654697
- https://go.dev/issue/71984
- https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ
- https://pkg.go.dev/vuln/GO-2025-3503
- https://go-review.googlesource.com/q/project:net
- https://security.netapp.com/advisory/ntap-20250509-0007
- http://www.openwall.com/lists/oss-security/2025/03/07/2
More Go standard library vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
- TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
Sources
- CVE-2025-22870 · CVE Program
- CVE-2025-22870 · NVD
- FIRST EPSS
- GHSA-qxp5-gwg8-xv66 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-22870 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences