ALT-PU-2025-3858-2

Package update golang in branch sisyphus

Version1.24.1-alt1

Published2026-02-04

Max severityMEDIUM

Severity:

Closed issues (3)

MEDIUM4.4

Уязвимость пакетов net/http, x/net/proxy и x/net/http/httpproxy языка программирования Go, позволяющая нарушителю оказать воздействие на конфиденциальность и доступность защищаемой информации

Published: 2025-07-02Modified: 2026-04-20

CVSS 3.xMEDIUM 4.4

CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

CVSS 2.0LOW 3.2

CVSS:2.0/AV:L/AC:L/Au:S/C:P/I:N/A:P

References

CVE-2025-22870

MEDIUM4.4

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Published: 2025-03-12Modified: 2026-04-16

CVSS 3.xMEDIUM 4.4

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References

GHSA-qxp5-gwg8-xv66

MEDIUM4.4

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Published: 2025-03-13Modified: 2026-04-24

CVSS 3.xMEDIUM 4.4

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References