CVE-2025-4673: Go Standard Library net/http Sensitive Header Leak on Cross-Origin Redirects

Background

The Go Standard Library, particularly the net/http package, provides essential functionalities for HTTP client and server implementations. It allows developers to create robust web applications by handling HTTP requests and responses efficiently. However, the package has been found to have a vulnerability that can lead to sensitive information leakage during cross-origin redirects.

Vulnerability Detail

The vulnerability arises from the failure to clear sensitive headers, specifically Proxy-Authorization and Proxy-Authenticate, during cross-origin redirects. This oversight can potentially expose sensitive information to unintended parties, as these headers may contain authentication credentials. The issue is particularly concerning for applications that rely on proxy servers for network requests, as it can lead to unauthorized access and data breaches.

go get stdlib@vgo1.25.5

Workaround

As a temporary workaround, developers can manually clear sensitive headers before making cross-origin requests. This can be achieved by implementing a custom HTTP client that overrides the default behavior of the net/http package. Below is an example code snippet:

package main

import (
    "net/http"
)

func customClient() *http.Client {
    return &http.Client{
        Transport: &http.Transport{
            Proxy: http.ProxyFromEnvironment,
        },
    }
}

func main() {
    client := customClient()
    req, _ := http.NewRequest("GET", "http://example.com", nil)
    req.Header.Del("Proxy-Authorization")
    req.Header.Del("Proxy-Authenticate")
    client.Do(req)
}

Conclusion

The CVE-2025-4673 vulnerability in the Go Standard Library's net/http package poses a significant risk of sensitive information leakage through cross-origin redirects. It is crucial for developers to update to the latest patched versions or implement workarounds to mitigate this risk.

See every vulnerability recorded for stdlib →

FAQ