VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Mar 5, 2024· Updated Apr 15, 2026

CVE-2023-45289

CVE-2023-45289

Description

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Go's net/http client incorrectly forwards sensitive headers on HTTP redirects to cross-origin domains, allowing credential leakage via malicious redirects.

Vulnerability

In Go's net/http package, when following an HTTP redirect to a domain that is not a subdomain or exact match of the original domain, sensitive headers like Authorization and Cookie should not be forwarded. However, a maliciously crafted redirect response can bypass this protection and cause these headers to be sent to an attacker-controlled domain [1][2].

Exploitation

An attacker who controls a redirect target can craft a response that tricks the http.Client into forwarding sensitive headers. The attack requires the client to make a request that triggers a redirect, and the attacker must be able to control the redirect endpoint [3][4]. No authentication is needed beyond the initial request.

Impact

A successful exploit could lead to disclosure of credentials or session tokens, allowing the attacker to impersonate the user or access protected resources. The severity is medium (CVSS 4.3) due to the preconditions required.

Mitigation

This vulnerability is fixed in Go 1.22.1 and Go 1.21.8 [2]. Users are advised to update their Go versions. There is no known workaround.

References
  1. security - 5 CVEs fixed in Go 1.22.1 and Go 1.21.8, 1 CVE fixed in google.golang.org/protobuf
  2. [security] Go 1.22.1 and Go 1.21.8 are released
  3. GO-2024-2600 - Go Packages
  4. net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect [CVE-2023-45289]

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1365

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.