CVE-2025-4673: Sensitive headers not cleared on cross-origin redirect in net/http
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
Other sources
Sensitive headers not cleared on cross-origin redirect in net/http
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.23.10-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.24.1-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.18.8-9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.22.7-5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.24.4-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.24.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.23.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2025-4673 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2025-0913 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2025-22874 - Compensating control
Apply a mitigative configuration/control to prevent Proxy-Authorization and Proxy-Authenticate header leakage across cross-origin redirects while patching net/http for 'Sensitive headers not cleared on cross-origin redirect'.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4673?
CVE-2025-4673 has a medium severity rating due to the risk of leaking sensitive information through improperly handled headers.
How do I fix CVE-2025-4673?
To fix CVE-2025-4673, ensure that Proxy-Authorization and Proxy-Authenticate headers are not exposed during cross-origin redirects.
What types of applications are affected by CVE-2025-4673?
CVE-2025-4673 affects applications utilizing the Go programming language, particularly in scenarios involving proxy headers during redirection.
What data could be leaked due to CVE-2025-4673?
CVE-2025-4673 could potentially leak sensitive data such as authentication credentials and session tokens.
Is there a workaround for CVE-2025-4673 before a patch is available?
A temporary workaround for CVE-2025-4673 includes adjusting proxy configurations to sanitize headers before cross-origin redirects.