The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-binUpgrade golang-testsUpgrade delveUpgrade golang-srcUpgrade golang-docsUpgrade golang-miscUpgrade go-toolsetUpgrade golang | Apr 11, 2025 | Jan 28, 2025 |
| Alpine Linux | — | Upgrade go | Aug 8, 2025 | Jan 28, 2025 |
| Amazon Linux Ami 2 | — | Upgrade golang-docsUpgrade golang-testsUpgrade golang-binUpgrade golang-srcUpgrade golang-miscUpgrade golangUpgrade golang-shared | Mar 27, 2025 | Jan 28, 2025 |
| Amazon_linux_2023 | — | Upgrade golang-testsUpgrade golang-docsUpgrade golang-sharedUpgrade golang-binUpgrade golangUpgrade golang-srcUpgrade golang-misc | Mar 10, 2025 | Jan 17, 2025 |
| Debian | — | Upgrade golang-1.24 | May 15, 2025 | Jan 28, 2025 |
| Freebsd | — | Upgrade go122Upgrade go123 | Dec 10, 2025 | Jan 21, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jul 11, 2025 | Jan 28, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Aug 13, 2025 | Jun 30, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Jul 21, 2025 | Jan 28, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jul 1, 2025 | Jan 28, 2025 |
| Oracle_linux | — | Upgrade golangUpgrade golang-srcUpgrade yggdrasilUpgrade go-toolsetUpgrade golang-docsUpgrade delveUpgrade golang-testsUpgrade golang-miscUpgrade golang-binUpgrade yggdrasil-devel | Apr 11, 2025 | Jan 17, 2025 |
| Redhat_linux | — | Upgrade delve-debugsourceUpgrade osbuild-composer-debuginfoUpgrade golang-testsUpgrade rhc-debugsourceNo solution existsUpgrade osbuild-composer-coreUpgrade osbuild-composer-tests-debuginfoUpgrade yggdrasil-develUpgrade golang-raceUpgrade golang-miscUpgrade delve-debuginfoUpgrade opentelemetry-collectorUpgrade yggdrasil-examples-debuginfoUpgrade golang-srcUpgrade yggdrasil-debuginfoUpgrade golangUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-composerUpgrade delveUpgrade golang-docsUpgrade osbuild-composer-workerUpgrade rhcUpgrade osbuild-composer-debugsourceUpgrade rhc-develUpgrade go-toolsetUpgrade osbuild-composer-worker-debuginfoUpgrade yggdrasil-debugsourceUpgrade rhc-debuginfoUpgrade yggdrasilUpgrade golang-bin | Mar 28, 2025 | Jan 28, 2025 |
| Rocky_linux | — | Upgrade golang-binUpgrade osbuild-composer-debugsourceUpgrade yggdrasil-debugsourceUpgrade yggdrasil-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade delve-debugsourceUpgrade golangUpgrade osbuild-composerUpgrade yggdrasil-develUpgrade osbuild-composer-coreUpgrade go-toolsetUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-debuginfoUpgrade delveUpgrade delve-debuginfoUpgrade yggdrasilUpgrade osbuild-composer-worker | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade go1.22-docUpgrade go1.23-openssl-raceUpgrade go1.23-opensslUpgrade go1.23-docUpgrade govulncheck-vulndbUpgrade go1.22Upgrade go1.22-openssl-raceUpgrade go1.23Upgrade go1.24Upgrade go1.22-raceUpgrade go1.24-docUpgrade go1.23-raceUpgrade go1.22-opensslUpgrade go1.24-libstdUpgrade go1.24-opensslUpgrade go1.24-raceUpgrade go1.24-openssl-raceUpgrade go1.23-openssl-docUpgrade go1.22-openssl-doc | Dec 5, 2025 | Apr 11, 2025 |
| Ubuntu | — | Upgrade golang-1.22-goUpgrade golang-1.22-srcUpgrade golang-1.22 | Jun 20, 2025 | Jan 28, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Jan 28, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub