# CVE-2025-22870: golang-1.22: Matching of hosts against proxy patterns can improperly treat an IPv6 zoneID as a hostname component

CVE-2025-22870 is fixed in 32 products on 1 platform, first by SUSE-SU-2025:0802-1, released March 6, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2025-22870
- Priority: Routine
- CVSS: 4.4 (Medium)
- EPSS: 0.0043
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 6, 2025

## Description

Matching of hosts against proxy patterns can improperly treat an IPv6 zoneID as a hostname component. For example, when the NO_PROXY environmentvariable is set to "*.example.com", a request to "[::1%25.example.com]:80`will incorrectly match and not be proxied.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | amazon-ssm-agent opensuse-leap 15.6 | 3.3.1611.0-150000.5.23.1 | [SUSE-SU-2025:0873-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0873-1.md) | Mar 14, 2025 |
| Linux | amazon-ssm-agent opensuse-leap 16.0 | 3.3.4624.0-160000.1.1 | [OPENSUSE-SU-2026:21079-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21079-1.md) | Jun 17, 2026 |
| Linux | amazon-ssm-agent sles 15.6 | 3.3.4624.0-150000.5.37.1 | [SUSE-SU-2026:2467-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2467-1.md) | Jun 19, 2026 |
| Linux | amazon-ssm-agent sles 15.7 | 3.3.4624.0-150000.5.37.1 | [SUSE-SU-2026:2467-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2467-1.md) | Jun 19, 2026 |
| Linux | amazon-ssm-agent sles 16.0 | 3.3.4624.0-160000.1.1 | [SUSE-SU-2026:22157-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22157-1.md) | Jun 17, 2026 |
| Linux | apptainer opensuse-leap 15.6 | 1.4.5-150600.4.12.1 | [SUSE-SU-2026:0439-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0439-1.md) | Feb 11, 2026 |
| Linux | apptainer opensuse-leap 15.6 | 1.3.6-150600.4.9.1 | [SUSE-SU-2025:0980-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0980-1.md) | Mar 21, 2025 |
| Linux | apptainer sles 15.6 | 1.3.6-150600.4.9.1 | [SUSE-SU-2025:0980-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0980-1.md) | Mar 21, 2025 |
| Linux | apptainer sles 15.7 | 1.4.5-150600.4.12.1 | [SUSE-SU-2026:0439-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0439-1.md) | Feb 11, 2026 |
| Linux | cheat opensuse-leap 16.0 | 4.4.2-bp160.2.1 | [OPENSUSE-SU-2025:20177-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2025-20177-1.md) | Dec 18, 2025 |
| Linux | containerized-data-importer sles 15.7 | 1.64.0-150700.9.11.1 | [SUSE-SU-2026:2493-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2493-1.md) | Jun 22, 2026 |
| Linux | containerized-data-importer1.65 opensuse-leap 16.0 | 1.65.0-160000.3.1 | [OPENSUSE-SU-2026:21824-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21824-1.md) | Sep 9, 2026 |
| Linux | cosign opensuse-leap 15.6 | 2.5.0-150400.3.27.1 | [SUSE-SU-2025:1333-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1333-1.md) | Apr 17, 2025 |
| Linux | cosign sles 15.6 | 2.5.0-150400.3.27.1 | [SUSE-SU-2025:1333-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1333-1.md) | Apr 17, 2025 |
| Linux | go1.23 opensuse-leap 15.6 | 1.23.7-150000.1.24.1 | [SUSE-SU-2025:0803-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0803-1.md) | Mar 6, 2025 |
| Linux | go1.23 sles 15.6 | 1.23.7-150000.1.24.1 | [SUSE-SU-2025:0803-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0803-1.md) | Mar 6, 2025 |
| Linux | go1.23-openssl opensuse-leap 15.6 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.23-openssl sles 15.6 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.23-openssl sles 15.7 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.24 opensuse-leap 15.6 | 1.24.1-150000.1.12.1 | [SUSE-SU-2025:0802-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0802-1.md) | Mar 6, 2025 |
| Linux | go1.24 sles 15.6 | 1.24.1-150000.1.12.1 | [SUSE-SU-2025:0802-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0802-1.md) | Mar 6, 2025 |
| Linux | golang amzn 2023 | 1.24.1-1.amzn2023.0.1 | [ALAS2023-2025-913](https://patchblox.com/security/data/fix/linux/alas2023-2025-913.md) | Mar 26, 2025 |
| Linux | golang-1.22 Ubuntu 22.04.1 LTS (jammy) | 1.22.2-2~22.04.3 | [golang-1.22 1.22.2-2~22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.22-1.22.2-2-22.04.3.md) | Jun 11, 2025 |
| Linux | golang-1.22 Ubuntu 24.04.5 LTS (noble) | 1.22.2-2ubuntu0.4 | [golang-1.22 1.22.2-2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-golang-1.22-1.22.2-2ubuntu0.4.md) | Jun 11, 2025 |
| Linux | golang-1.22 Ubuntu 24.10 (oracular) | 1.22.8-1ubuntu0.1 | [golang-1.22 1.22.8-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-golang-1.22-1.22.8-1ubuntu0.1.md) | Jan 16, 2026 |
| Linux | golang-1.22-go Ubuntu 22.04.1 LTS (jammy) | 1.22.2-2~22.04.3 | [golang-1.22-go 1.22.2-2~22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.22-go-1.22.2-2-22.04.3.md) | Jun 11, 2025 |
| Linux | golang-1.22-go Ubuntu 24.04.5 LTS (noble) | 1.22.2-2ubuntu0.4 | [golang-1.22-go 1.22.2-2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-golang-1.22-go-1.22.2-2ubuntu0.4.md) | Jun 11, 2025 |
| Linux | golang-1.22-go Ubuntu 24.10 (oracular) | 1.22.8-1ubuntu0.1 | [golang-1.22-go 1.22.8-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-golang-1.22-go-1.22.8-1ubuntu0.1.md) | Jan 16, 2026 |
| Linux | golang-1.22-src Ubuntu 22.04.1 LTS (jammy) | 1.22.2-2~22.04.3 | [golang-1.22-src 1.22.2-2~22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.22-src-1.22.2-2-22.04.3.md) | Jun 11, 2025 |
| Linux | golang-1.22-src Ubuntu 24.04.5 LTS (noble) | 1.22.2-2ubuntu0.4 | [golang-1.22-src 1.22.2-2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-golang-1.22-src-1.22.2-2ubuntu0.4.md) | Jun 11, 2025 |
| Linux | golang-1.22-src Ubuntu 24.10 (oracular) | 1.22.8-1ubuntu0.1 | [golang-1.22-src 1.22.8-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-golang-1.22-src-1.22.8-1ubuntu0.1.md) | Jan 16, 2026 |
| Linux | golang-1.24 Debian 13.5 (trixie) | 1.24.1-1 | [DEBIAN-CVE-2025-22870](https://patchblox.com/security/data/fix/linux/debian-cve-2025-22870.md) | Mar 12, 2025 |
| Linux | golang-bin amzn 2023 | 1.24.1-1.amzn2023.0.1 | [ALAS2023-2025-913](https://patchblox.com/security/data/fix/linux/alas2023-2025-913.md) | Mar 26, 2025 |
| Linux | golang-docs amzn 2023 | 1.24.1-1.amzn2023.0.1 | [ALAS2023-2025-913](https://patchblox.com/security/data/fix/linux/alas2023-2025-913.md) | Mar 26, 2025 |
| Linux | golang-github-prometheus-alertmanager opensuse-leap 15.6 | 0.26.0-150100.4.25.2 | [SUSE-SU-2025:01992-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01992-1.md) | Jun 18, 2025 |
| Linux | golang-github-prometheus-alertmanager opensuse-leap 16.0 | 0.28.1-bp160.1.1 | [OPENSUSE-SU-2026:21136-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21136-1.md) | Jun 18, 2026 |
| Linux | golang-github-prometheus-alertmanager sles 15.6 | 0.26.0-150100.4.25.2 | [SUSE-SU-2025:01992-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01992-1.md) | Jun 18, 2025 |
| Linux | golang-github-prometheus-alertmanager sles 15.7 | 0.26.0-150100.4.25.2 | [SUSE-SU-2025:01992-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01992-1.md) | Jun 18, 2025 |
| Linux | golang-github-prometheus-node_exporter opensuse-leap 15.6 | 1.9.1-150100.3.35.2 | [SUSE-SU-2025:01988-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01988-1.md) | Jun 18, 2025 |
| Linux | golang-github-prometheus-node_exporter sles 15.6 | 1.9.1-150100.3.35.2 | [SUSE-SU-2025:01988-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01988-1.md) | Jun 18, 2025 |
| Linux | golang-github-prometheus-node_exporter sles 15.7 | 1.9.1-150100.3.35.2 | [SUSE-SU-2025:01988-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01988-1.md) | Jun 18, 2025 |
| Linux | golang-github-prometheus-prometheus opensuse-leap 15.6 | 2.53.4-150100.4.26.2 | [SUSE-SU-2025:01990-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01990-1.md) | Jun 18, 2025 |
| Linux | golang-github-prometheus-prometheus sles 15.6 | 2.53.4-150100.4.26.2 | [SUSE-SU-2025:01990-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01990-1.md) | Jun 18, 2025 |
| Linux | golang-github-prometheus-prometheus sles 15.7 | 2.53.4-150100.4.26.2 | [SUSE-SU-2025:01990-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01990-1.md) | Jun 18, 2025 |
| Linux | golang-misc amzn 2023 | 1.24.1-1.amzn2023.0.1 | [ALAS2023-2025-913](https://patchblox.com/security/data/fix/linux/alas2023-2025-913.md) | Mar 26, 2025 |
| Linux | golang-shared amzn 2023 | 1.24.1-1.amzn2023.0.1 | [ALAS2023-2025-913](https://patchblox.com/security/data/fix/linux/alas2023-2025-913.md) | Mar 26, 2025 |
| Linux | golang-src amzn 2023 | 1.24.1-1.amzn2023.0.1 | [ALAS2023-2025-913](https://patchblox.com/security/data/fix/linux/alas2023-2025-913.md) | Mar 26, 2025 |
| Linux | golang-tests amzn 2023 | 1.24.1-1.amzn2023.0.1 | [ALAS2023-2025-913](https://patchblox.com/security/data/fix/linux/alas2023-2025-913.md) | Mar 26, 2025 |
| Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 |
| Linux | grafana opensuse-leap 15.6 | 11.5.5-150200.3.72.2 | [SUSE-SU-2025:01991-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01991-1.md) | Jun 18, 2025 |
| Linux | grafana sles 15.6 | 11.5.5-150200.3.72.2 | [SUSE-SU-2025:01991-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01991-1.md) | Jun 18, 2025 |
| Linux | grafana sles 15.7 | 11.5.5-150200.3.72.2 | [SUSE-SU-2025:01991-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01991-1.md) | Jun 18, 2025 |
| Linux | helm opensuse-leap 15.6 | 3.17.2-150000.1.44.1 | [SUSE-SU-2025:1007-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1007-1.md) | Mar 25, 2025 |
| Linux | helm sles 15.6 | 3.17.2-150000.1.44.1 | [SUSE-SU-2025:1007-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1007-1.md) | Mar 25, 2025 |
| Linux | ignition opensuse-leap 15.6 | 2.14.0-150400.9.9.1 | [SUSE-SU-2025:02014-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02014-1.md) | Jun 19, 2025 |
| Linux | ignition sles 15.6 | 2.14.0-150400.9.9.1 | [SUSE-SU-2025:02014-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02014-1.md) | Jun 19, 2025 |
| Linux | ignition sles 15.7 | 2.14.0-150400.9.9.1 | [SUSE-SU-2025:02014-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02014-1.md) | Jun 19, 2025 |
| Linux | prometheus-blackbox_exporter opensuse-leap 15.6 | 0.26.0-150000.1.27.1 | [SUSE-SU-2025:01989-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01989-1.md) | Jun 18, 2025 |
| Linux | prometheus-blackbox_exporter opensuse-leap 16.0 | 0.26.0-bp160.1.1 | [OPENSUSE-SU-2026:22026-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22026-1.md) | Oct 6, 2026 |
| Linux | skopeo opensuse-leap 15.6 | 1.14.4-150300.11.22.1 | [SUSE-SU-2025:1055-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1055-1.md) | Mar 28, 2025 |
| Linux | skopeo sles 15.6 | 1.14.4-150300.11.22.1 | [SUSE-SU-2025:1055-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1055-1.md) | Mar 28, 2025 |
| Linux | squashfuse opensuse-leap 15.6 | 0.5.0-150600.3.2.1 | [SUSE-SU-2026:0439-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0439-1.md) | Feb 11, 2026 |
| Linux | squashfuse sles 15.7 | 0.5.0-150600.3.2.1 | [SUSE-SU-2026:0439-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0439-1.md) | Feb 11, 2026 |
| Linux | vexctl opensuse-leap 15.6 | 0.4.1+git78.f951e3a-150000.1.11.1 | [SUSE-SU-2026:0592-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0592-1.md) | Feb 20, 2026 |
| Linux | vexctl opensuse-leap 16.0 | 0.4.4+git20.5d61136-160000.1.1 | [OPENSUSE-SU-2026:21481-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21481-1.md) | Jul 30, 2026 |
| Linux | warewulf4 opensuse-leap 15.6 | 4.6.0-150500.6.34.1 | [SUSE-SU-2025:1094-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1094-1.md) | Apr 2, 2025 |
| Linux | warewulf4 sles 15.6 | 4.6.0-150500.6.34.1 | [SUSE-SU-2025:1094-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1094-1.md) | Apr 2, 2025 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.