fr Sign in

6.8 Medium

CVE-2025-4673 Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive…

Description

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

Affected products and versions

Product	Affected versions	Fixed in
net/http 1.24	1.24.0-0 → < 1.24.4	1.24.4
net/http 1.23	earliest → < 1.23.10	1.23.10

References

go.dev go.dev
go.dev go.dev
groups.google.com groups.google.com
pkg.go.dev pkg.go.dev

Timeline

Published June 11, 2025
Last modified June 11, 2025

The 26 CVEs of net/http →

CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently 7.5 High CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream… 9.1 Critical CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams… 7.5 High CVE-2026-78667 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS)… 7.5 High

Track this CVE