CVE-2025-22870: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Overview

Severity: Medium (CVSS 4.4)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Exploit Status: Not Exploited
Patch Tuesday: 2025-Mar
Released: 2025-03-27
Last Updated: 2026-02-18
EPSS Score: 0.03% (percentile: 7.2%)

FAQ

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.

Detection & Weaponization (1 sources)

Maturity: Exploit

GitHub PoC: 1 repositories

Affected Products (39)

Other

19833-17086
19668-17086
20123-17086
19945-17086
19921-17086
19343-17084
17547-17084
19755-17086
19679-17084
17667-17084
17188-16823
17193-16823
19320-16823
17201-16823
17582-17084
17589-17084
17591-17084
17585-17084
19322-17084
19323-17084
19324-17084
17588-17084
17583-17084
19325-17084
19936-17086
19923-17086
19698-17086
19730-17086
19344-17084
19697-17084
18315-17084
19836-17086
19939-17086
19693-17084
19347-17084
19718-17086
19335-17084
20370-17086
18447-17086

Revision History

2025-03-27: Information published.
2025-04-24: Information published.
2025-03-28: Information published.
2025-04-01: Information published.
2025-04-08: Information published.
2025-04-11: Information published.
2025-04-12: Information published.
2025-04-16: Information published.
2025-04-19: Information published.
2025-04-22: Information published.
2025-07-11: Added golang to CBL-Mariner 2.0 Added git-lfs to CBL-Mariner 2.0 Added telegraf to CBL-Mariner 2.0 Added keda to CBL-Mariner 2.0 Added azcopy to CBL-Mariner 2.0 Added influxdb to CBL-Mariner 2.0 Added packer to CBL-Mariner 2.0 Added vitess to CBL-Mariner 2.0 Added prometheus to Azure Linux 3.0 Added influxdb to Azure Linux 3.0 Added packer to Azure Linux 3.0 Added azcopy to Azure Linux 3.0 Added keda to Azure Linux 3.0 Added git-lfs to Azure Linux 3.0 Added prometheus-process-exporter to Azure Linux 3.0 Added prometheus-node-exporter to Azure Linux 3.0 Added vitess to Azure Linux 3.0 Added telegraf to Azure Linux 3.0
2026-02-18: Information published.