CVE-2025-22870
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
- Published Mar 12, 2025
- CVSS 4.4 medium
- 0.4% chance of exploitation in the next 30 days (EPSS)