CVE-2025-4673: Golang Package Sensitive Headers Leak on Cross-Origin Redirect
Summary
CVE-2025-4673: Sensitive headers not cleared on cross-origin redirect in net/http. Affects golang across 2 version ranges.
< 1.23.10
>= 1.24.0-0, < 1.24.4
Fixed in 1.23.10 or 1.24.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2025-4673 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, also known as Go, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other applications. The language's net/http package provides HTTP client and server implementations, making it a crucial component for web-based applications. However, a vulnerability has been identified in this package that can lead to sensitive information leakage during cross-origin redirects.
Vulnerability Detail
The vulnerability arises from the persistence of Proxy-Authorization and Proxy-Authenticate headers during cross-origin redirects. This behavior can potentially expose sensitive information to unintended recipients, as these headers may contain authentication tokens or credentials. The issue is particularly concerning in scenarios where sensitive data is transmitted across different origins, leading to possible unauthorized access and data breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.23.101.23.10 -
>= 1.24.0-0, < 1.24.41.24.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can implement a middleware that clears sensitive headers before performing a cross-origin redirect. Here is a sample code snippet in Go:
func clearSensitiveHeaders(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
r.Header.Del("Proxy-Authorization")
r.Header.Del("Proxy-Authenticate")
next.ServeHTTP(w, r)
})
}
Conclusion
In summary, CVE-2025-4673 is a significant vulnerability in the Golang package that can lead to sensitive information leakage during cross-origin redirects. It is crucial to update to the patched version or implement a workaround to mitigate the risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for golang →
FAQ
CVE-2025-4673 is a vulnerability in the Golang package that allows sensitive headers to persist during cross-origin redirects, potentially leaking sensitive information.
If your application uses the Golang net/http package and performs cross-origin redirects, it may inadvertently expose sensitive authentication headers to unauthorized parties.
If updating is not immediately possible, implement the provided middleware workaround to clear sensitive headers before redirects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences may include unauthorized access to sensitive data, potential data breaches, and compromised user credentials.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
