CVE-2025-22870

CVE Description

Input misinterpretation in Go’s proxy host matching logic (CWE‑115). When NO_PROXY is set to a domain pattern like *.example.com, a host specified as [::1%25.example.com]:80 may erroneously match the pattern and bypass the proxy rules