When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade delveUpgrade go-toolsetUpgrade golang-docsUpgrade git-lfsUpgrade golang-binUpgrade golangUpgrade golang-miscUpgrade golang-srcUpgrade golang-tests | May 8, 2024 | Mar 5, 2024 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Mar 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade dockerUpgrade golang-testsUpgrade golangUpgrade docker-debuginfoUpgrade golang-miscUpgrade golang-srcUpgrade golang-binUpgrade golang-sharedUpgrade golang-docs | May 31, 2024 | Mar 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golang-srcUpgrade docker-debuginfoUpgrade dockerUpgrade golang-sharedUpgrade golang-binUpgrade golangUpgrade docker-debugsourceUpgrade golang-miscUpgrade golang-docsUpgrade golang-tests | Feb 17, 2025 | Mar 5, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Mar 5, 2024 |
| Freebsd | — | Upgrade go122Upgrade go121 | Dec 10, 2025 | Mar 6, 2024 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 8, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | May 13, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jun 26, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jul 1, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jul 17, 2024 | Mar 5, 2024 |
| Oracle_linux | — | Upgrade golang-srcUpgrade git-lfsUpgrade go-toolsetUpgrade golang-miscUpgrade golang-docsUpgrade golangUpgrade delveUpgrade golang-testsUpgrade golang-bin | May 8, 2024 | Mar 5, 2024 |
| Redhat Openshift | — | Upgrade openshiftUpgrade ose-azure-acr-image-credential-provider | Jun 28, 2024 | Mar 5, 2024 |
| Redhat_linux | — | Upgrade golang-testsUpgrade golang-miscUpgrade delve-debugsourceUpgrade golangUpgrade golang-binUpgrade git-lfs-debugsourceUpgrade git-lfs-debuginfoUpgrade golang-srcNo solution existsUpgrade go-toolsetUpgrade git-lfsUpgrade golang-docsUpgrade delve-debuginfoUpgrade delve | May 1, 2024 | Mar 5, 2024 |
| Rocky_linux | — | Upgrade delve-debugsourceUpgrade delveUpgrade git-lfs-debugsourceUpgrade delve-debuginfoUpgrade golangUpgrade golang-binUpgrade git-lfs-debuginfoUpgrade go-toolsetUpgrade git-lfs | May 13, 2024 | Mar 5, 2024 |
| Suse | — | Upgrade go1.21-docUpgrade go1.21-raceUpgrade go1.21Upgrade go1.22-docUpgrade go1.22-raceUpgrade go1.22 | Mar 8, 2024 | Mar 5, 2024 |
| Ubuntu | — | Upgrade golang-1.22-srcUpgrade golang-1.21-goUpgrade golang-1.22-goUpgrade golang-1.21Upgrade golang-1.21-srcUpgrade golang-1.22 | Jul 10, 2024 | Mar 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Mar 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub