CVE-2024-45336: Sensitive headers incorrectly sent after cross-domain redirect in net/http

Deferred

AliasesRHSA-2025:9514UBUNTU-CVE-2024-45336DEBIAN-CVE-2024-45336+1722 more

Published 28-01-2025Last modified 18-09-2025

Vulnerability summary

CVE-2024-45336 is a medium (CVSS 6.1) vulnerability in go standard library net/http. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 54.1% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.1/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.73%

0%100%

Low · +0.06 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 29 · Related 400

MGASA-2025-0021 OPENSUSE-SU-2025:14693-1 OPENSUSE-SU-2025:14694-1 OPENSUSE-SU-2025:14695-1 OPENSUSE-SU-2025:14710-1 OPENSUSE-SU-2025:15030-1+94 more

Showing 100 of 415.

Timeline

28-01-2025
PublishedVulnerability first disclosed.
18-09-2025
Last modifiedVulnerability information updated.

Description

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

CVSS metrics

6 scores · 6 sources · 1 version

v3.16.1

EPSS trend

Probability

0.73%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

Increase +0.06 pp

From 0.67% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r22
actions-runner-controller< 0.10.1-r2
actions-runner-controller-fips< 0.10.1-r2
age< 1.2.1-r1
age-fips< 1.2.1-r1

amazon-cloudwatch-agent-fips< 1.300052.0-r0
amazon-k8s-cni< 1.19.2-r1
amazon-k8s-cni-fips< 1.19.2-r2
amazon-k8s-cni-init-fips< 1.19.2-r2
amazon-k8s-cni-init-fips-compat< 1.19.2-r2
ansible-operator< 1.37.1-r1
apache-beam-java-sdk< 2.62.0-r0
apache-beam-python-3.11-sdk< 2.62.0-r0
argo-events< 1.9.5-r1
argo-events-fips< 1.9.5-r1
argo-rollouts< 1.7.2-r4
argo-workflows< 3.6.3-r1
argo-workflows-fips< 3.6.2-r4
atlantis< 0.32.0-r1
atlantis-fips< 0.32.0-r1
authservice-fips< 1.0.4-r0
aws-application-networking-k8s< 1.1.0-r2
aws-ebs-csi-driver< 1.52.1-r0
aws-efs-csi-driver< 2.1.4-r1
aws-efs-csi-driver-fips< 2.1.4-r1
aws-flb-cloudwatch< 1.9.4-r14
aws-flb-cloudwatch-compat-fips< 1.9.4-r7
aws-flb-cloudwatch-fips< 1.9.4-r7
aws-flb-firehose< 1.7.2-r14
aws-flb-firehose-fips< 1.7.2-r7
aws-flb-kinesis< 1.10.2-r15
aws-flb-kinesis-fips< 1.10.2-r8
aws-load-balancer-controller< 2.11.0-r2
aws-load-balancer-controller-fips< 2.12.0-r1
aws-network-policy-agent< 1.1.6-r1
aws-network-policy-agent-fips< 1.1.6-r1
aws-privateca-issuer< 1.4.0-r3
aws-privateca-issuer-fips< 1.4.0-r3
aws-signer-notation-plugin< 1.0.350-r1
aws-signer-notation-plugin-fips< 1.0.350-r1
azure-aad-pod-identity-mic< 1.8.17-r16
azuredisk-csi-1.28< 1.28.11-r6
azuredisk-csi-1.29< 1.29.12-r1
azuredisk-csi-1.30< 1.30.7-r1
azuredisk-csi-1.31< 1.31.2-r1
azuredisk-csi-fips-1.28< 1.28.11-r5
azuredisk-csi-fips-1.29< 1.29.12-r1
azuredisk-csi-fips-1.30< 1.30.7-r1
azuredisk-csi-fips-1.31< 1.31.2-r1
bank-vaults< 1.20.4-r23
bank-vaults-fips< 1.20.4-r19
bazelisk< 1.25.0-r1
beats-7< 7.17.27-r1
beats-fips-7< 7.17.27-r1
bom< 0.6.0-r15
boring-registry< 0.15.5-r1
boring-registry-fips< 0.15.5-r1
buildkitd-fips< 0.19.0-r0
cadvisor< 0.51.0-r3
cadvisor-fips< 0.50.0-r4
calico-3.29< 3.29.1-r4
calico-fips-3.29< 3.29.1-r5
capslock< 0.2.7-r1
cass-operator< 1.23.0-r2
cass-operator-fips< 1.23.0-r2
cass-operator-fips-no-pvc-delete< 1.23.0-r2
cert-manager-cmctl< 2.1.1-r4
cert-manager-cmctl-fips< 2.1.1-r4
cert-manager-webhook-pdns< 2.5.1-r10
cert-manager-webhook-pdns-fips< 2.5.1-r12
certificate-transparency< 1.3.1-r1
certificate-transparency-fips< 1.3.1-r1
cfssl< 1.6.5-r14
cfssl-fips< 1.6.5-r6
chainctl< 0.2.59-r0
chartmuseum< 0.16.2-r10
chartmuseum-fips< 0.16.2-r8
checksec< 3.0.0-r1
cilium-1.15< 1.15.13-r0
cilium-1.15-clustermesh-apiserver< 1.15.13-r0
cilium-1.15-container-init< 1.15.13-r0
cilium-1.15-container-init-compat< 1.15.13-r0
cilium-1.15-hubble-relay< 1.15.13-r0
cilium-1.15-iptables< 1.15.13-r0
cilium-1.15-operator-aws< 1.15.13-r0
cilium-1.15-operator-generic< 1.15.13-r0
cilium-envoy-fips-1.15< 1.15.13-r0
cilium-envoy-fips-1.16< 1.16.6-r0
cilium-fips-1.15< 1.15.13-r0
cilium-fips-1.16< 1.16.6-r0
cloud-provider-aws-1.28< 1.28.10-r3
cloud-provider-aws-1.29< 1.29.7-r3
cloud-provider-aws-1.30< 1.30.6-r3
cloud-provider-aws-1.31< 1.31.4-r3
cloud-provider-aws-1.32< 1.32.0-r3
cloud-provider-aws-fips-1.28< 1.28.10-r3
cloud-provider-aws-fips-1.29< 1.29.7-r3
cloud-provider-aws-fips-1.30< 1.30.6-r3
cloud-provider-aws-fips-1.31< 1.31.4-r3
cloud-provider-aws-fips-1.32< 1.32.0-r3
cloud-provider-azure-1.27< 1.27.21-r3
cloud-provider-azure-1.28< 1.28.13-r3
cloud-provider-azure-1.29< 1.29.11-r3
cloud-provider-azure-1.30< 1.30.7-r3
cloud-provider-azure-1.31< 1.31.1-r4
cloud-provider-azure-1.32< 1.32.0-r1
cloud-provider-azure-cloud-controller-manager-1.31< 1.31.1-r4
cloud-provider-azure-cloud-controller-manager-1.31-compat< 1.31.1-r4
cloud-provider-azure-cloud-node-manager-1.31< 1.31.1-r4
cloud-provider-azure-cloud-node-manager-1.31-compat< 1.31.1-r4
cloud-provider-azure-fips-1.27< 1.27.21-r3
cloud-provider-azure-fips-1.28< 1.28.13-r3
cloud-provider-azure-fips-1.29< 1.29.11-r3
cloud-provider-azure-fips-1.30< 1.30.7-r3
cloud-provider-azure-fips-1.31< 1.31.1-r3
cloud-provider-azure-fips-1.32< 1.32.0-r1
cloudnative-pg< 1.25.0-r1
cloudnative-pg-fips< 1.25.0-r1
cloudprober-fips< 0.13.9-r0
cluster-autoscaler-1.31< 1.31.1-r5
cluster-autoscaler-1.31-compat< 1.31.1-r5
cluster-autoscaler-1.32< 1.32.0-r2
cluster-autoscaler-fips-1.31< 1.31.1-r3
cluster-autoscaler-fips-1.32< 1.32.0-r2
cni-plugins< 1.6.2-r1
cni-plugins-fips< 1.6.2-r1
configmap-reload< 0.14.0-r2
configmap-reload-fips< 0.14.0-r1
configmap-reload-fips-0.11< 0.11.1-r13
configmap-reload-fips-0.12< 0.12.0-r12
confluent-common-docker< 7.6.0-r10
conftest< 0.56.0-r3
conftest-fips< 0.56.0-r3
consul-1.18< 1.18.2-r6
consul-1.19< 1.19.2-r5
consul-1.20< 1.20.2-r1
consul-fips-1.19< 1.19.2-r5
consul-fips-1.20< 1.20.2-r1
consul-k8s-1.1< 1.1.18-r1
consul-k8s-1.3< 1.3.9-r3
consul-k8s-1.4< 1.4.8-r1
consul-k8s-1.5< 1.5.5-r1
consul-k8s-1.6< 1.6.2-r1
consul-k8s-fips-1.1< 1.1.18-r1
consul-k8s-fips-1.3< 1.3.9-r3
consul-k8s-fips-1.4< 1.4.8-r1
consul-k8s-fips-1.5< 1.5.5-r1
consul-k8s-fips-1.6< 1.6.2-r1
containerd-1< 1.7.25-r1
containerd-2< 2.0.2-r1
containerd-fips< 2.0.2-r1
containerd-service-fips< 2.0.2-r1
containerd-shim-runc-v2-fips< 2.0.2-r1
containerd-stress-fips< 2.0.2-r1
controller-gen< 0.17.1-r1
cortex< 1.18.1-r4
cortex-fips< 1.18.1-r4
cosign< 2.4.1-r5
cosign-fips< 2.4.1-r4
crane< 0.20.3-r1
cri-tools< 1.32.0-r3
croc< 10.2.1-r1
crossplane-provider-aws< 1.19.0-r1
crossplane-provider-azure< 1.11.0-r1
crossplane-provider-keycloak< 1.7.0-r4
crossplane-provider-keycloak-fips< 1.7.0-r3
crossplane-provider-sql< 0.11.0-r1
crossplane-provider-sql-fips< 0.11.0-r1
ctop< 0.7.7-r21
ctr-fips< 2.0.2-r1
dagdotdev< 0.0.12-r2
dask-gateway< 2024.1.0-r14
dataplaneapi< 3.0.4-r1
dataplaneapi-fips< 3.0.4-r1
delve< 1.24.0-r1
descheduler< 0.32.1-r1
dex< 2.41.1-r4
dex-fips< 2.41.1-r4
dex-k8s-authenticator< 1.4.0-r15
direnv< 2.35.0-r1
distribution< 3.0.0-r5
distribution-fips< 3.0.0-r4
dive< 0.12.0-r14
docker-cli-fips< 27.5.1-r0
docker-compose< 2.32.4-r1
docker-compose-fips< 2.32.4-r1
docker-credential-acr-env< 0.7.0-r17
docker-credential-acr-env-fips< 0.7.0-r2
docker-credential-cgr< 0.2.59-r0
docker-credential-ecr-login< 0.9.0-r3
docker-credential-ecr-login-fips< 0.9.0-r1
docker-credential-gcr< 2.1.26-r2
docker-credential-gcr-fips< 2.1.26-r1
docker-fips< 27.5.1-r0
dockerize< 0.9.2-r1
dockerize-fips< 0.9.2-r1
eck-operator< 2.16.1-r0
eck-operator-fips< 2.16.1-r0
elvish< 0.21.0-r1

Show all 199

Alpine1 product

go< 1.23.5-r0

2 vendors · 200 products · Showing 200 of 1270

References

19 links

Show all 19 references

access.redhat.com/security/cve/CVE-2024-45336REPORT
www.cve.org/CVERecord?id=CVE-2024-45336AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2024-45336AdvisoryOval
github.com/golang/go/issues/70530ARTICLE
groups.google.com/g/golang-announce/c/sSaUhLA-2SIARTICLEREPORT
ubuntu.com/security/CVE-2024-45336REPORT
ubuntu.com/security/notices/USN-7574-1Advisory
security-tracker.debian.org/tracker/CVE-2024-45336Advisory
security.alpinelinux.org/vuln/CVE-2024-45336Advisory