CVE-2025-4673

Timeline

Detection, updates, and resolution for this record.

1. Jun 11, 2025 · OSV.dev

   Detected

   Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

2. Oct 14, 2026 · OSV.dev

   Fix available

   stdlib fixed in 1.23.10

3. Oct 14, 2026 · OSV.dev

   Fix available

   stdlib fixed in 1.23.10

4. Oct 14, 2026 · OSV.dev

   Updated

   Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

Affected

• Go stdlib0 → 1.23.10

Sources

• CVE.orgCVE-2025-4673

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2025-4673

  30-day exploitation probability 0.7%

  first.org
• OSV.devGO-2025-3751

  Sensitive headers not cleared on cross-origin redirect in net/http

  osv.dev

References

• FIX · go.dev
• REPORT · go.dev
• WEB · groups.google.com