VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jan 28, 2025· Updated Apr 15, 2026

CVE-2024-45336

CVE-2024-45336

Description

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Go's net/http client can incorrectly restore sensitive headers after a cross-domain redirect chain, potentially leaking Authorization headers to an unintended host.

Vulnerability

CVE-2024-45336 is a logic flaw in Go's net/http client regarding the handling of sensitive headers during HTTP redirects. The client correctly drops headers like Authorization when following a redirect to a different domain (e.g., from a.com to b.com). However, if the redirect chain subsequently returns to the original domain, the client restores those sensitive headers. This means a chain like a.com → b.com/1 → b.com/2 can incorrectly send an Authorization header intended only for a.com to b.com/2 [1][2]. The root cause is a state management error where the client fails to permanently clear headers after a cross-domain redirect, instead only tracking the most recent redirect target [4].

Exploitation

An attacker who controls a redirect endpoint (e.g., compromised or malicious server b.com) can craft a response chain that induces the client to re-send sensitive headers after a cross-domain step. The attack requires the client to follow a sequence: initial request to a trusted domain a.com, which redirects to attacker-controlled b.com/1, and then a same-domain redirect to b.com/2. The client's flawed logic restores the original Authorization header when it sees a same-domain redirect back to b.com, even though the original cross-domain boundary was crossed [2][3]. No additional authentication or network position beyond the ability to issue HTTP redirects is required for the attacker server.

Impact

If successful, the attacker receives sensitive headers (e.g., Authorization, cookies via Cookie header) that were meant only for the original domain. This could lead to credential theft, session hijacking, or unauthorized access to the victim's resources. The vulnerability is rated Medium (CVSS 6.1) due to the need for a specific redirect chain and the reliance on client-side behavior [1][3].

Mitigation

Go patched this issue in versions 1.22.11, 1.23.5, and 1.24rc2, released on January 28, 2025 [1][2]. Users should upgrade their Go toolchain or rebuild applications using an updated standard library. There is no workaround other than avoiding untrusted redirect chains or manually stripping headers after following redirects. The vulnerability was reported by Kyle Seely [4].

References
  1. [security] Go 1.24 Release Candidate 2 is released
  2. [security] Go 1.23.5 and Go 1.22.11 are released
  3. GO-2025-3420 - Go Packages
  4. net/http: sensitive headers incorrectly sent after cross-domain redirect [CVE-2024-45336]

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2885

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.