Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
{ "url": "https://pkg.go.dev/vuln/GO-2025-3503", "review_status": "REVIEWED" }
{ "imports": [ { "symbols": [ "config.useProxy", "domainMatch.match" ], "path": "golang.org/x/net/http/httpproxy" }, { "symbols": [ "Dial", "FromEnvironment", "FromEnvironmentUsing", "PerHost.AddFromString", "PerHost.Dial", "PerHost.DialContext", "PerHost.dialerForRequest" ], "path": "golang.org/x/net/proxy" } ] }