CVE-2025-4673

Aliases:GO-2025-3751BIT-golang-2025-4673
Advisory lineage Upstream: 0 Downstream: 18
Deferred
Published: 11 Jun 2025, 16:42
Last modified:11 Jun 2025, 17:59

Vulnerability Summary

Overall Risk (default)
medium
27/100
CVSS Score
6.8 MEDIUM
v3.1 (cve.org)
EPSS Score
0.07% LOW
0% probability +0.06%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Jun 2025, 16:42
Published
Vulnerability first disclosed
11 Jun 2025, 17:59
Last Modified
Vulnerability information updated

Description

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.07%• Percentile: 23%

Affected Systems

  • go standard library•net/http

    < 1.23.10 | ≥ 1.24.0-0, < 1.24.4

  • Go•stdlib

    ≥ 1.24.0-0, < 1.24.4

References (4)