CVE-2025-4673: Sensitive headers not cleared on cross-origin redirect in net/http
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4673?
CVE-2025-4673 has a medium severity rating due to the risk of leaking sensitive information through improperly handled headers.
How do I fix CVE-2025-4673?
To fix CVE-2025-4673, ensure that Proxy-Authorization and Proxy-Authenticate headers are not exposed during cross-origin redirects.
What types of applications are affected by CVE-2025-4673?
CVE-2025-4673 affects applications utilizing the Go programming language, particularly in scenarios involving proxy headers during redirection.
What data could be leaked due to CVE-2025-4673?
CVE-2025-4673 could potentially leak sensitive data such as authentication credentials and session tokens.
Is there a workaround for CVE-2025-4673 before a patch is available?
A temporary workaround for CVE-2025-4673 includes adjusting proxy configurations to sanitize headers before cross-origin redirects.