When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-docsUpgrade delveUpgrade go-toolsetUpgrade golang-miscUpgrade golangUpgrade golang-binUpgrade golang-testsUpgrade golang-srcUpgrade git-lfs | May 8, 2024 | Mar 5, 2024 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Mar 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-srcUpgrade golang-testsUpgrade docker-debuginfoUpgrade dockerUpgrade golangUpgrade golang-miscUpgrade golang-sharedUpgrade golang-docsUpgrade golang-bin | May 31, 2024 | Mar 5, 2024 |
| Amazon_linux_2023 | — | Upgrade docker-debugsourceUpgrade golang-testsUpgrade golangUpgrade golang-docsUpgrade golang-miscUpgrade golang-binUpgrade golang-srcUpgrade golang-sharedUpgrade dockerUpgrade docker-debuginfo | Feb 17, 2025 | Mar 5, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Mar 5, 2024 |
| Freebsd | — | Upgrade go121Upgrade go122 | Dec 10, 2025 | Mar 6, 2024 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 8, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | May 13, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jun 26, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Jul 1, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Jul 17, 2024 | Mar 5, 2024 |
| Oracle_linux | — | Upgrade golang-binUpgrade golang-testsUpgrade delveUpgrade golang-miscUpgrade go-toolsetUpgrade golangUpgrade golang-srcUpgrade git-lfsUpgrade golang-docs | May 8, 2024 | Mar 5, 2024 |
| Redhat Openshift | — | Upgrade ose-azure-acr-image-credential-providerUpgrade openshift | Jun 28, 2024 | Mar 5, 2024 |
| Redhat_linux | — | No solution existsUpgrade git-lfs-debugsourceUpgrade golangUpgrade golang-srcUpgrade git-lfs-debuginfoUpgrade delve-debugsourceUpgrade golang-binUpgrade golang-miscUpgrade golang-testsUpgrade golang-docsUpgrade delveUpgrade go-toolsetUpgrade git-lfsUpgrade delve-debuginfo | May 1, 2024 | Mar 5, 2024 |
| Rocky_linux | — | Upgrade golang-binUpgrade git-lfsUpgrade go-toolsetUpgrade delve-debuginfoUpgrade git-lfs-debuginfoUpgrade golangUpgrade delve-debugsourceUpgrade git-lfs-debugsourceUpgrade delve | May 13, 2024 | Mar 5, 2024 |
| Suse | — | Upgrade go1.22-raceUpgrade go1.22Upgrade go1.22-docUpgrade go1.21-raceUpgrade go1.21-docUpgrade go1.21 | Mar 8, 2024 | Mar 5, 2024 |
| Ubuntu | — | Upgrade golang-1.22-srcUpgrade golang-1.21-goUpgrade golang-1.22Upgrade golang-1.21Upgrade golang-1.21-srcUpgrade golang-1.22-go | Jul 10, 2024 | Mar 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Mar 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub