VYPR
← All advisories
Medium severity6.8NVD Advisory· Published Jun 11, 2025· Updated Apr 15, 2026

CVE-2025-4673

CVE-2025-4673

Description

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Go net/http retains Proxy-Authorization and Proxy-Authenticate headers on cross-origin redirects, potentially leaking credentials.

Root

Cause The net/http package in Go fails to clear Proxy-Authorization and Proxy-Authenticate headers when following cross-origin redirects. This behavior violates the expected security practice of stripping sensitive headers on redirects to a different origin. [1][3]

Exploitation

An attacker controlling a malicious server can craft an HTTP redirect to a different origin, causing the client to include the proxy credentials in the subsequent request. This requires the client to be using a proxy and the attacker to intercept or redirect the initial connection. [3]

Impact

Successful exploitation leads to leakage of proxy authentication credentials to an attacker-controlled origin. These credentials may be reused for unauthorized access or further attacks. [1]

Mitigation

The vulnerability is addressed in Go 1.24.4 and Go 1.23.10. Users should upgrade to these versions or later. There is no known workaround. [1]

References
  1. [security] Go 1.24.4 and Go 1.23.10 are released
  2. net/http: sensitive headers not cleared on cross-origin redirect CVE-2025-4673

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

3642

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.