CVE-2025-4673

Description

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

Affected packages (5)

• Bitnami/golangfrom 0, < 1.23.10, >= 1.24.0-0, < 1.24.4
• Debian/golang-1.15from 0
• Debian/golang-1.19from 0
• Debian/golang-1.24from 0, < 1.24.4-1
• Go/stdlibfrom 0, < 1.23.10, >= 1.24.0-0, < 1.24.4

CVSS scores

References (6)

• ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2025-4673
• PATCHhttps://go.dev/cl/679257
• REPORThttps://go.dev/issue/73816
• WEBhttps://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A
• WEBhttps://nvd.nist.gov/vuln/detail/CVE-2025-4673
• WEBhttps://pkg.go.dev/vuln/GO-2025-3751