What is CVE-2025-22870?

CVE-2025-22870 is a medium-severity vulnerability in Golang.org/x/net Golang.org/x/net/http/httpproxy, classified under CWE-115. CVSS score: 4.4/10. Published 2025-03-12.

How severe is CVE-2025-22870?

Medium severity. CVSS v3 base score is 4.4 out of 10.

Is CVE-2025-22870 known to be exploited?

16 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Golang.org/x/net Golang.org/x/net/http/httpproxy

CVE-2025-22870

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly m…

EPSS: 0.004 (30.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L.

Affected products

Golang.org/x/net Golang.org/x/net/http/httpproxy — versions 0
Golang.org/x/net Golang.org/x/net/proxy — versions 0
Go Standard Library Net/http — versions 0, 1.24.0-0

Weakness classification (CWE)

CWE-115

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-22870?: CVE-2025-22870 is a medium-severity vulnerability in Golang.org/x/net Golang.org/x/net/http/httpproxy, classified under CWE-115. CVSS score: 4.4/10. Published 2025-03-12.
How severe is CVE-2025-22870?: Medium severity. CVSS v3 base score is 4.4 out of 10.
Is CVE-2025-22870 known to be exploited?: 16 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.