This vulnerability (CVE-2025-22870) in the Go standard library net/http package involves improper handling of IPv6 zone IDs when matching hosts against proxy exclusion patterns defined in the NO_PROXY environment variable. Specifically, an IPv6 address with a zone ID, such as "[::1%25.example.com]:80", can be misinterpreted so that the zone ID is treated as a hostname component. This leads to incorrect matching against patterns like "*.example.com", causing the request to bypass the proxy when it should not. The issue is classified under CWE-115 (Misinterpretation of Input). It affects Go versions from 0 up to 1.24.0-0. The CVSS v3.1 base score is 4.4, with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and low availability impact. No patch or remediation details are currently provided.

The vulnerability can cause requests to bypass proxy configurations unintentionally, potentially exposing internal network traffic or circumventing intended network controls. The confidentiality impact is limited, and there is no impact on integrity. Availability impact is low. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious when relying on NO_PROXY patterns involving IPv6 zone IDs. Review proxy configuration and consider avoiding patterns that could be affected by this issue. Monitor vendor communications for updates and patches.