CVE-2025-22870

The golang.org/x/net package is vulnerable to an improper interpretation of input (CWE-115) where host matching against proxy patterns may treat an IPv6 zone ID as a hostname component. This allows certain requests, such as those to [::1%25.example.com]:80, to be incorrectly matched and bypass pr...