Go/golang.org/x/net CVE-2025-22870: medium 4.4, EPSS 0.43%

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Action: Upgrade golang.org/x/net to 0.36.0 or later.

go get golang.org/x/net@v0.36.0

Affected

Fixed versions

Sources

• osv: GO-2025-3503#Go/golang.org/x/net
• nvd: CVE-2025-22870
• https://go.dev/cl/654697
• https://go.dev/issue/71984
• https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ

CVE-2025-22870 · published 2025-03-12T18:17:07Z · modified 2026-04-16T22:45:11.580296Z · JSON