Server-side Request Forgery (SSRF) Affecting golang.org/x/net/http/httpproxy package, versions <0.36.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GOLANGORGXNETHTTPHTTPPROXY-9058601
- published5 Mar 2025
- disclosed4 Mar 2025
- creditJuho Forsén
Introduced: 4 Mar 2025
NewCVE-2025-22870 (opens in a new tab)How to fix?
Upgrade golang.org/x/net/http/httpproxy to version 0.36.0 or higher.
Overview
golang.org/x/net/http/httpproxy is a package for HTTP proxy determination based on environment variables, as provided by net/http's ProxyFromEnvironment function
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in proxy.go, because hostname matching against proxy patterns may treat an IPv6 zone ID as a hostname component. An environment variable value like *.example.com could be matched to a request intended for [::1%25.example.com]:80.