Skip to content
This repository was archived by the owner on Dec 30, 2025. It is now read-only.

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net #3#25

Merged
rez1dent3 merged 1 commit intomasterfrom
sec-fix
Apr 2, 2025
Merged

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net #3#25
rez1dent3 merged 1 commit intomasterfrom
sec-fix

Conversation

@rez1dent3
Copy link
Contributor

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

@rez1dent3 rez1dent3 self-assigned this Apr 2, 2025
@rez1dent3 rez1dent3 merged commit f385836 into master Apr 2, 2025
2 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant