CVE catalog

CVE-2025-22870

Go vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 4.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-1.19bookworm1.19.8-2vulnerable
Ubuntugolang-1.19nobleNot reportedvulnerable
Ubuntugolang-1.22noble1.22.2-2ubuntu0.4fixed
Ubuntugolang-1.22-docnoble1.22.2-2ubuntu0.4fixed
Ubuntugolang-1.22-gonoble1.22.2-2ubuntu0.4fixed
Ubuntugolang-1.22-srcnoble1.22.2-2ubuntu0.4fixed
Gogolang.org/x/netNot reported0.36.0fixed
GostdlibNot reported1.24.1fixed
GostdlibNot reported1.23.7fixed
Opensusecontainerized-data-importer1.65tumbleweed1.65.0-2.1fixed
Opensuseopatumbleweed1.6.0-1.1fixed
Opensusegolang-github-prometheus-alertmanagertumbleweed0.28.1-2.1fixed
Opensuseamazon-ssm-agenttumbleweed3.3.1957.0-2.1fixed
Opensusehelmtumbleweed3.17.2-1.1fixed
Suseamazon-ssm-agentlinux enterprise module for public cloud 123.3.1611.0-4.39.1fixed
Suseamazon-ssm-agentlinux enterprise module for public cloud 15 sp33.3.1611.0-150000.5.23.1fixed
Suseamazon-ssm-agentlinux enterprise module for public cloud 15 sp43.3.1611.0-150000.5.23.1fixed
Suseamazon-ssm-agentlinux enterprise module for public cloud 15 sp53.3.1611.0-150000.5.23.1fixed
Suseamazon-ssm-agentlinux enterprise module for public cloud 15 sp63.3.1611.0-150000.5.23.1fixed
Opensuseamazon-ssm-agentleap 15.63.3.1611.0-150000.5.23.1fixed
Opensusego1.23tumbleweed1.23.7-1.1fixed
Susego1.23linux enterprise module for development tools 15 sp61.23.7-150000.1.24.1fixed
Opensusego1.23leap 15.61.23.7-150000.1.24.1fixed
Opensusegolang-github-prometheus-node_exportertumbleweed1.9.1-2.1fixed
Suseskopeolinux enterprise micro 5.51.14.4-150300.11.22.1fixed
Suseskopeolinux enterprise module for basesystem 15 sp61.14.4-150300.11.22.1fixed
Opensuseskopeoleap 15.61.14.4-150300.11.22.1fixed
Opensusego1.24tumbleweed1.24.1-1.1fixed
Susehelmlinux enterprise micro 5.53.17.2-150000.1.44.1fixed
Susehelmlinux enterprise module for containers 15 sp63.17.2-150000.1.44.1fixed
Susehelmlinux enterprise module for package hub 15 sp63.17.2-150000.1.44.1fixed
Opensusehelmleap 15.63.17.2-150000.1.44.1fixed
Opensuseteleporttumbleweed17.3.3-1.1fixed
Susego1.24linux enterprise module for development tools 15 sp61.24.1-150000.1.12.1fixed
Opensusego1.24leap 15.61.24.1-150000.1.12.1fixed
Ubuntugolang-1.1014.041.10.4-2ubuntu1~14.04.1vulnerable
Ubuntugolang-1.1016.041.10.4-2ubuntu1~16.04.1vulnerable
Ubuntugolang-1.1016.041.10.4-2ubuntu1~16.04.2vulnerable
Ubuntugolang-1.616.041.6-0ubuntu1vulnerable
Ubuntugolang-1.616.041.6-0ubuntu2vulnerable
Ubuntugolang-1.616.041.6-0ubuntu3vulnerable
Ubuntugolang-1.616.041.6-0ubuntu4vulnerable
Ubuntugolang-1.616.041.6-0ubuntu5vulnerable
Ubuntugolang-1.616.041.6.1-0ubuntu1vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04.2vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04.3vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04.4vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2.22.04.1vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2.22.04.1+esm1vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2.22.04.2vulnerable
Ubuntugolang-1.18pro1.18.1-1ubuntu1~18.04.3vulnerable
Ubuntugolang-1.18pro1.18.1-1ubuntu1~18.04.4vulnerable
Ubuntugolang-1.18pro1.18.1-1ubuntu1~18.04.4+esm1vulnerable
Ubuntugolang-1.1018.041.10~rc1-1vulnerable
Ubuntugolang-1.1018.041.10~rc1-1ubuntu1vulnerable
Ubuntugolang-1.1018.041.10~rc1-2ubuntu1vulnerable
Ubuntugolang-1.1018.041.10~rc2-1ubuntu1vulnerable
Ubuntugolang-1.1018.041.10-1ubuntu1vulnerable
Ubuntugolang-1.1018.041.10.1-1ubuntu2vulnerable
Ubuntugolang-1.1018.041.10.4-2ubuntu1~18.04.1vulnerable
Ubuntugolang-1.1018.041.10.4-2ubuntu1~18.04.2vulnerable
Ubuntugolang-1.16pro1.16.2-0ubuntu1~20.04vulnerable
Ubuntugolang-1.16pro1.16.2-0ubuntu1~20.04.1vulnerable
Ubuntugolang-1.16pro1.16.2-0ubuntu1~20.04.1+esm1vulnerable
Ubuntugolang-1.818.041.8.3-2ubuntu1vulnerable
Ubuntugolang-1.818.041.8.3-2ubuntu1.18.04.1vulnerable
Ubuntugolang-1.918.041.9.1-2ubuntu1vulnerable
Ubuntugolang-1.918.041.9.2-1ubuntu1vulnerable
Ubuntugolang-1.918.041.9.2-3ubuntu1vulnerable
Ubuntugolang-1.918.041.9.3-1ubuntu1vulnerable
Ubuntugolang-1.918.041.9.4-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.1-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.3-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.4-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.5-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.6-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.6-2ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.7-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.8-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.8-1ubuntu1.1vulnerable
Ubuntugolang-1.1320.041.13.8-1ubuntu1.2vulnerable
Ubuntugolang-1.1420.041.14~beta1-1vulnerable
Ubuntugolang-1.1420.041.14~beta1-2vulnerable
Ubuntugolang-1.1420.041.14~rc1-1vulnerable
Ubuntugolang-1.1420.041.14-1vulnerable
Ubuntugolang-1.1420.041.14.1-1vulnerable
Ubuntugolang-1.1420.041.14.2-1vulnerable
Ubuntugolang-1.1420.041.14.2-1ubuntu1vulnerable
Ubuntugolang-1.1420.041.14.3-2ubuntu2~20.04.1vulnerable
Ubuntugolang-1.1420.041.14.3-2ubuntu2~20.04.2vulnerable
Ubuntugolang-1.1820.041.18.1-1ubuntu1~20.04.1vulnerable
Ubuntugolang-1.1820.041.18.1-1ubuntu1~20.04.2vulnerable
Ubuntugolang-1.1820.041.18.1-1ubuntu1~20.04.3vulnerable
Ubuntugolang-1.2020.041.20.3-1ubuntu0.1~20.04vulnerable
Ubuntugolang-1.2020.041.20.3-1ubuntu0.1~20.04.1vulnerable
Ubuntugolang-1.2120.041.21.1-1~ubuntu20.04.1vulnerable
Ubuntugolang-1.2120.041.21.1-1~ubuntu20.04.2vulnerable
Ubuntugolang-1.2120.041.21.1-1~ubuntu20.04.3vulnerable
Ubuntugolang-1.2220.041.22.2-2~20.04.1vulnerable
Ubuntugolang-1.2220.041.22.2-2~20.04.2vulnerable
Ubuntugolang-1.2220.041.22.2-2~20.04.3vulnerable
Ubuntugolang-1.1722.041.17-1ubuntu2vulnerable
Ubuntugolang-1.1722.041.17.3-1ubuntu1vulnerable
Ubuntugolang-1.1722.041.17.3-1ubuntu2vulnerable
Ubuntugolang-1.1722.041.17.13-3ubuntu1vulnerable
Ubuntugolang-1.1722.041.17.13-3ubuntu1.2vulnerable
Ubuntugolang-1.1722.041.17.13-3ubuntu1.3vulnerable
Ubuntugolang-1.1822.041.18~beta1-0ubuntu1vulnerable
Ubuntugolang-1.1822.041.18~beta2-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18~beta2-1ubuntu2vulnerable
Ubuntugolang-1.1822.041.18~rc1-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1.1vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1.2vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1.3vulnerable
Ubuntugolang-1.2022.041.20.3-1ubuntu0.1~22.04vulnerable
Ubuntugolang-1.2022.041.20.3-1ubuntu0.1~22.04.1vulnerable
Ubuntugolang-1.2122.041.21.1-1~ubuntu22.04.1vulnerable
Ubuntugolang-1.2122.041.21.1-1~ubuntu22.04.2vulnerable
Ubuntugolang-1.2122.041.21.1-1~ubuntu22.04.3vulnerable
Ubuntugolang-1.2122.041.21.1-1~ubuntu22.04.4vulnerable
Ubuntugolang-1.2222.041.22.2-2~22.04vulnerable
Ubuntugolang-1.2222.041.22.2-2~22.04.1vulnerable
Ubuntugolang-1.2222.041.22.2-2~22.04.2vulnerable
Ubuntugolang-1.2222.041.22.2-2~22.04.3fixed
Ubuntugolang-1.2322.041.23.1-1~22.04vulnerable
Ubuntugolang-1.2322.041.23.1-1~22.04.2vulnerable
Ubuntugolang-1.2322.041.23.1-1~22.04.3vulnerable
Ubuntugolang-1.2422.041.24.4-1ubuntu1~22.04.1vulnerable
Ubuntugolang-1.2422.041.24.4-1ubuntu1~22.04.2vulnerable
Ubuntugolang-1.2422.041.24.13-2~22.04.1vulnerable
Ubuntugolang-1.2422.041.24.13-2~22.04.2vulnerable
Ubuntugolang-1.2124.041.21.1-1vulnerable
Ubuntugolang-1.2124.041.21.3-1vulnerable
Ubuntugolang-1.2124.041.21.4-1vulnerable
Ubuntugolang-1.2124.041.21.5-1vulnerable
Ubuntugolang-1.2124.041.21.6-1vulnerable
Ubuntugolang-1.2124.041.21.7-1vulnerable
Ubuntugolang-1.2124.041.21.7-2vulnerable
Ubuntugolang-1.2124.041.21.8-1vulnerable
Ubuntugolang-1.2124.041.21.8-1build1vulnerable
Ubuntugolang-1.2124.041.21.9-1vulnerable
Ubuntugolang-1.2124.041.21.9-1ubuntu0.1vulnerable
Ubuntugolang-1.2224.041.22~rc1-2vulnerable
Ubuntugolang-1.2224.041.22.0-1vulnerable
Ubuntugolang-1.2224.041.22.0-2vulnerable
Ubuntugolang-1.2224.041.22.1-1vulnerable
Ubuntugolang-1.2224.041.22.1-1build1vulnerable
Ubuntugolang-1.2224.041.22.2-2vulnerable
Ubuntugolang-1.2224.041.22.2-2ubuntu0.1vulnerable
Ubuntugolang-1.2224.041.22.2-2ubuntu0.2vulnerable
Ubuntugolang-1.2224.041.22.2-2ubuntu0.3vulnerable
Ubuntugolang-1.2224.041.22.2-2ubuntu0.4fixed
Ubuntugolang-1.2324.041.23.1-1~24.04vulnerable
Ubuntugolang-1.2324.041.23.1-1~24.04.1vulnerable
Ubuntugolang-1.2424.041.24.4-1ubuntu1~24.04.1vulnerable
Ubuntugolang-1.2424.041.24.4-1ubuntu1~24.04.2vulnerable
Ubuntugolang-1.2424.041.24.13-2~24.04.1vulnerable
Ubuntugolang-1.2325.101.23.8-1vulnerable
Ubuntugolang-1.2325.101.23.10-1vulnerable
Ubuntugolang-1.2325.101.23.10-1ubuntu0.2vulnerable
Ubuntugolang-1.2425.101.24.2-1vulnerable
Ubuntugolang-1.2425.101.24.2-2vulnerable
Ubuntugolang-1.2425.101.24.4-1vulnerable
Ubuntugolang-1.2425.101.24.4-1ubuntu1vulnerable
Ubuntugolang-1.2326.041.23.10-1vulnerable
Ubuntugolang-1.2426.041.24.4-1ubuntu1vulnerable
Ubuntugolang-1.2426.041.24.9-1vulnerable
Ubuntugolang-1.2426.041.24.13-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-1.19sourcebookworm(unfixed)not yet assignedNot reportedNot reported
Ubuntugolang-1.22debnoble1.22.2-2ubuntu0.4Not reportedNot reportedNot reported
Ubuntugolang-1.22-docdebnoble1.22.2-2ubuntu0.4Not reportedNot reportedNot reported
Ubuntugolang-1.22-godebnoble1.22.2-2ubuntu0.4Not reportedNot reportedNot reported
Ubuntugolang-1.22-srcdebnoble1.22.2-2ubuntu0.4Not reportedNot reportedNot reported
Gogolang.org/x/netGoNot reported0.36.0Not reportedGHSA-QXP5-GWG8-XV66Not reported
GostdlibGoNot reported1.24.1Not reportedNot reportedNot reported
GostdlibGoNot reported1.23.7Not reportedNot reportedNot reported
Opensusecontainerized-data-importer1.65rpmtumbleweed1.65.0-2.1Not reportedOPENSUSE-SU-2026:11305-1Not reported
Opensuseoparpmtumbleweed1.6.0-1.1Not reportedOPENSUSE-SU-2025:15253-1Not reported
Opensusegolang-github-prometheus-alertmanagerrpmtumbleweed0.28.1-2.1Not reportedOPENSUSE-SU-2025:15178-1Not reported
Opensuseamazon-ssm-agentrpmtumbleweed3.3.1957.0-2.1Not reportedOPENSUSE-SU-2025:14867-1Not reported
Opensusehelmrpmtumbleweed3.17.2-1.1Not reportedOPENSUSE-SU-2025:14906-1Not reported
Suseamazon-ssm-agentrpmlinux enterprise module for public cloud 123.3.1611.0-4.39.1Not reportedSUSE-SU-2025:0866-1Not reported
Suseamazon-ssm-agentrpmlinux enterprise module for public cloud 15 sp33.3.1611.0-150000.5.23.1Not reportedSUSE-SU-2025:0873-1Not reported
Suseamazon-ssm-agentrpmlinux enterprise module for public cloud 15 sp43.3.1611.0-150000.5.23.1Not reportedSUSE-SU-2025:0873-1Not reported
Suseamazon-ssm-agentrpmlinux enterprise module for public cloud 15 sp53.3.1611.0-150000.5.23.1Not reportedSUSE-SU-2025:0873-1Not reported
Suseamazon-ssm-agentrpmlinux enterprise module for public cloud 15 sp63.3.1611.0-150000.5.23.1Not reportedSUSE-SU-2025:0873-1Not reported
Opensuseamazon-ssm-agentrpmleap 15.63.3.1611.0-150000.5.23.1Not reportedSUSE-SU-2025:0873-1Not reported
Opensusego1.23rpmtumbleweed1.23.7-1.1Not reportedOPENSUSE-SU-2025:14855-1Not reported
Susego1.23rpmlinux enterprise module for development tools 15 sp61.23.7-150000.1.24.1Not reportedSUSE-SU-2025:0803-1Not reported
Opensusego1.23rpmleap 15.61.23.7-150000.1.24.1Not reportedSUSE-SU-2025:0803-1Not reported
Opensusegolang-github-prometheus-node_exporterrpmtumbleweed1.9.1-2.1Not reportedOPENSUSE-SU-2025:15041-1Not reported
Suseskopeorpmlinux enterprise micro 5.51.14.4-150300.11.22.1Not reportedSUSE-SU-2025:1055-1Not reported
Suseskopeorpmlinux enterprise module for basesystem 15 sp61.14.4-150300.11.22.1Not reportedSUSE-SU-2025:1055-1Not reported
Opensuseskopeorpmleap 15.61.14.4-150300.11.22.1Not reportedSUSE-SU-2025:1055-1Not reported
Opensusego1.24rpmtumbleweed1.24.1-1.1Not reportedOPENSUSE-SU-2025:14856-1Not reported
Susehelmrpmlinux enterprise micro 5.53.17.2-150000.1.44.1Not reportedSUSE-SU-2025:1007-1Not reported
Susehelmrpmlinux enterprise module for containers 15 sp63.17.2-150000.1.44.1Not reportedSUSE-SU-2025:1007-1Not reported
Susehelmrpmlinux enterprise module for package hub 15 sp63.17.2-150000.1.44.1Not reportedSUSE-SU-2025:1007-1Not reported
Opensusehelmrpmleap 15.63.17.2-150000.1.44.1Not reportedSUSE-SU-2025:1007-1Not reported
Opensuseteleportrpmtumbleweed17.3.3-1.1Not reportedOPENSUSE-SU-2025:14863-1Not reported
Susego1.24rpmlinux enterprise module for development tools 15 sp61.24.1-150000.1.12.1Not reportedSUSE-SU-2025:0802-1Not reported
Opensusego1.24rpmleap 15.61.24.1-150000.1.12.1Not reportedSUSE-SU-2025:0802-1Not reported
Ubuntugolang-1.22deb22.041.22.2-2~22.04.3Not reportedUBUNTU-CVE-2025-22870Not reported
Ubuntugolang-1.22deb24.041.22.2-2ubuntu0.4Not reportedUBUNTU-CVE-2025-22870Not reported

Notes

[bookworm] golang-1.19: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-1.19]Affected
    Details (2)
    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

  • [golang-1.19-doc]Affected

    Source package: [golang-1.19]

    Details (2)
    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

  • [golang-1.19-go]Affected

    Source package: [golang-1.19]

    Details (2)
    • 1.19.8-2 · amd64 · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

    • 1.19.8-2 · arm64 · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

  • [golang-1.19-src]Affected

    Source package: [golang-1.19]

    Details (2)
    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

[openSUSE Tumbleweed]

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]