CVE-2025-4673: Sensitive headers not cleared on cross-origin redirect in net/http

Deferred

AliasesRHSA-2025:10672RHSA-2025:15406RHSA-2025:15887+3558 more

Published 11-06-2025Last modified 11-06-2025

Vulnerability summary

CVE-2025-4673 is a medium (CVSS 6.8) vulnerability in go standard library net/http. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.67%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 401

MGASA-2025-0184 OPENSUSE-SU-2025:15223-1 OPENSUSE-SU-2025:15224-1 OPENSUSE-SU-2025:15225-1 OPENSUSE-SU-2026:11436-1 RHSA-2025:10676+94 more

Showing 100 of 402.

Timeline

11-06-2025
PublishedVulnerability first disclosed.
11-06-2025
Last modifiedVulnerability information updated.

Description

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

CVSS metrics

6 scores · 6 sources · 1 version

v3.16.8

EPSS trend

Probability

0.67%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.67% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

addon-resizer< 1.8.23-r6
addon-resizer-compat< 1.8.23-r6
addon-resizer-fips< 1.8.23-r6
addon-resizer-fips-compat< 1.8.23-r6
age< 1.2.1-r5

age-fips< 1.2.1-r5
agentbeat< 9.0.2-r1
agentbeat-fips< 9.0.2-r1
amass< 4.2.0-r24
amazon-cloudwatch-agent< 1.300056.1-r1
amazon-cloudwatch-agent-all< 1.300056.1-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard< 1.300056.1-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300056.1-r1
amazon-cloudwatch-agent-compat< 1.300056.1-r1
amazon-cloudwatch-agent-config-downloader< 1.300056.1-r1
amazon-cloudwatch-agent-config-downloader-fips< 1.300056.1-r1
amazon-cloudwatch-agent-config-translator< 1.300056.1-r1
amazon-cloudwatch-agent-config-translator-fips< 1.300056.1-r1
amazon-cloudwatch-agent-fips< 1.300056.1-r1
amazon-cloudwatch-agent-operator-fips< 3.0.1-r1
amazon-cloudwatch-agent-operator-fips-compat< 3.0.1-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent< 1.300056.1-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300056.1-r1
amazon-k8s-cni< 1.19.5-r1
amazon-k8s-cni-compat< 1.19.5-r1
amazon-k8s-cni-init< 1.19.5-r1
amazon-k8s-cni-init-compat< 1.19.5-r1
amazon-ssm-agent< 3.3.2656.0-r1
amazon-ssm-agent-ecs-exec< 3.3.2656.0-r1
amazon-ssm-agent-ecs-exec-fips< 3.3.2656.0-r1
amazon-ssm-agent-fips< 3.3.2656.0-r1
apache-beam-java-11-sdkAll versions (No fix recorded)
apache-beam-java-17-sdkAll versions (No fix recorded)
apache-beam-java-21-sdkAll versions (No fix recorded)
apache-beam-java-sdkAll versions (No fix recorded)
apko< 0.27.9-r1
apko-fips< 0.27.9-r1
auditbeat-7< 7.17.28-r14
auditbeat-7-oci-entrypoint< 7.17.28-r14
auditbeat-fips-7< 7.17.28-r14
authservice< 1.0.4-r8
authservice-compat< 1.0.4-r8
authservice-fips< 1.0.4-r8
authservice-fips-compat< 1.0.4-r8
aws-application-networking-k8s< 1.1.2-r0
aws-application-networking-k8s-compat< 1.1.2-r0
aws-application-networking-k8s-fips< 1.1.2-r15
aws-application-networking-k8s-fips-compat< 1.1.2-r15
aws-ebs-csi-driver< 1.44.0-r1
aws-efs-csi-driver< 2.1.8-r3
aws-efs-csi-driver-fips< 2.1.8-r2
aws-eks-pod-identity-agent< 0.1.30-r1
aws-eks-pod-identity-agent-compat< 0.1.30-r1
aws-eks-pod-identity-agent-fips< 0.1.30-r1
aws-flb-cloudwatch< 1.9.4-r17
aws-flb-cloudwatch-compat< 1.9.4-r17
aws-flb-cloudwatch-compat-fips< 1.9.4-r11
aws-flb-cloudwatch-fips< 1.9.4-r11
aws-flb-firehose< 1.7.2-r17
aws-flb-firehose-compat< 1.7.2-r17
aws-flb-firehose-compat-fips< 1.7.2-r11
aws-flb-firehose-fips< 1.7.2-r11
aws-flb-kinesis< 1.10.2-r18
aws-flb-kinesis-compat< 1.10.2-r18
aws-flb-kinesis-compat-fips< 1.10.2-r12
aws-flb-kinesis-fips< 1.10.2-r12
aws-iam-authenticator< 0.7.2-r1
aws-load-balancer-controller< 2.13.2-r2
aws-load-balancer-controller-compat< 2.13.2-r2
aws-load-balancer-controller-fips< 2.13.2-r2
aws-network-policy-agent-compat-fips< 1.2.1-r2
aws-network-policy-agent-fips< 1.2.1-r2
aws-privateca-issuer< 1.6.0-r1
aws-privateca-issuer-compat< 1.6.0-r1
aws-privateca-issuer-compat-fips< 1.6.0-r1
aws-privateca-issuer-fips< 1.6.0-r1
azcopy< 10.29.1-r1
azcopy-fips< 10.29.1-r1
azure-aad-pod-identity-mic< 1.8.17-r24
azure-aad-pod-identity-nmi< 1.8.17-r24
azure-container-networking< 1.6.25-r2
azure-service-operator< 2.13.0-r3
azure-service-operator-compat< 2.13.0-r3
azure-service-operator-fips< 2.13.0-r2
azure-vnet-cni< 1.6.25-r2
azure-workload-identity-webhook< 1.5.1-r0
azure-workload-identity-webhook-compat< 1.5.1-r0
azuredisk-csi-1.28< 1.28.12-r3
azuredisk-csi-1.28-compat< 1.28.12-r3
azuredisk-csi-1.29< 1.29.14-r3
azuredisk-csi-1.29-compat< 1.29.14-r3
azuredisk-csi-1.30< 1.30.12-r1
azuredisk-csi-1.30-compat< 1.30.12-r1
azuredisk-csi-fips-1.28< 1.28.12-r3
azuredisk-csi-fips-1.29< 1.29.14-r3
azuredisk-csi-fips-1.30< 1.30.12-r1
azuredisk-csi-fips-1.32< 1.32.7-r1
azuredisk-csi-fips-1.33< 1.33.1-r1
bank-vaults< 1.20.4-r31
bank-vaults-fips< 1.20.4-r28
bank-vaults-template< 1.20.4-r31
bank-vaults-template-fips< 1.20.4-r28
bazelisk< 1.26.0-r1
bazelisk-default< 1.26.0-r1
beats-7< 7.17.28-r14
beats-fips-7< 7.17.28-r14
blob-csi-1.23< 1.23.11-r3
blob-csi-1.23-compat< 1.23.11-r3
blob-csi-1.24< 1.24.10-r1
blob-csi-1.24-compat< 1.24.10-r1
blob-csi-1.26< 1.26.5-r1
blob-csi-1.26-compat< 1.26.5-r1
blob-csi-fips-1.23< 1.23.11-r3
blob-csi-fips-1.23-compat< 1.23.11-r3
blob-csi-fips-1.24< 1.24.10-r1
blob-csi-fips-1.24-compat< 1.24.10-r1
blob-csi-fips-1.25< 1.25.8-r1
blob-csi-fips-1.25-compat< 1.25.8-r1
blob-csi-fips-1.26< 1.26.5-r1
blob-csi-fips-1.26-compat< 1.26.5-r1
blobfuse2< 2.4.2-r2
blobfuse2-fips< 2.4.2-r1
blobfuse2-fips-health-monitor< 2.4.2-r1
blobfuse2-fips-syslog< 2.4.2-r1
blobfuse2-health-monitor< 2.4.2-r2
blobfuse2-syslog< 2.4.2-r2
bom< 0.6.0-r21
boring-registry< 0.16.4-r1
boring-registry-fips< 0.16.4-r1
buf< 1.54.0-r1
buildctl< 0.22.0-r1
buildctl-fips< 0.22.0-r1
buildkitd< 0.22.0-r1
buildkitd-fips< 0.22.0-r1
cadvisor-fips< 0.53.0-r1
calico-3.29< 3.29.4-r1
calico-3.30< 3.30.1-r1
calico-apiserver-3.29< 3.29.4-r1
calico-apiserver-3.30< 3.30.1-r1
calico-apiserver-compat-3.29< 3.29.4-r1
calico-apiserver-compat-3.30< 3.30.1-r1
calico-app-policy-3.29< 3.29.4-r1
calico-app-policy-3.30< 3.30.1-r1
calico-cni-3.29< 3.29.4-r1
calico-cni-3.30< 3.30.1-r1
calico-cni-compat-3.29< 3.29.4-r1
calico-cni-compat-3.30< 3.30.1-r1
calico-felix-3.29< 3.29.4-r1
calico-felix-3.30< 3.30.1-r1
calico-goldmane-3.30< 3.30.1-r1
calico-key-cert-provisioner-3.29< 3.29.4-r1
calico-key-cert-provisioner-3.30< 3.30.1-r1
calico-kube-controllers-3.29< 3.29.4-r1
calico-kube-controllers-3.30< 3.30.1-r1
calico-node-3.29< 3.29.4-r1
calico-node-3.30< 3.30.1-r1
calico-pod2daemon-3.29< 3.29.4-r1
calico-pod2daemon-3.30< 3.30.1-r1
calico-pod2daemon-flexvol-compat-3.29< 3.29.4-r1
calico-pod2daemon-flexvol-compat-3.30< 3.30.1-r1
calico-typha-client-3.29< 3.29.4-r1
calico-typha-client-3.30< 3.30.1-r1
calico-typhad-3.29< 3.29.4-r1
calico-typhad-3.30< 3.30.1-r1
calico-whisker-3.30< 3.30.1-r1
calico-whisker-backend-3.30< 3.30.1-r1
calicoctl-3.29< 3.29.4-r1
calicoctl-3.30< 3.30.1-r1
capslock< 0.2.7-r4
cargobump< 0.1.0-r4
cass-operator< 1.24.0-r2
cass-operator-compat< 1.24.0-r2
cass-operator-compat-fips< 1.24.0-r1
cass-operator-config< 1.24.0-r2
cass-operator-fips< 1.24.0-r1
cass-operator-fips-no-pvc-delete< 1.24.0-r1
cass-operator-fips-no-pvc-delete-compat< 1.24.0-r1
cert-manager-cmctl< 2.2.0-r1
cert-manager-cmctl-fips< 2.2.0-r1
cert-manager-fips-1.17< 1.17.2-r2
cert-manager-istio-csr< 0.14.1-r1
cert-manager-istio-csr-compat< 0.14.1-r1
cert-manager-webhook-pdns< 2.5.2-r7
cert-manager-webhook-pdns-fips< 2.5.2-r7
cfssl< 1.6.5-r20
cfssl-bundle< 1.6.5-r20
cfssl-bundle-fips< 1.6.5-r12
cfssl-certinfo< 1.6.5-r20
cfssl-certinfo-fips< 1.6.5-r12
cfssl-fips< 1.6.5-r12
cfssl-json< 1.6.5-r20
cfssl-json-fips< 1.6.5-r12
cfssl-mkbundle< 1.6.5-r20
cfssl-mkbundle-fips< 1.6.5-r12
cfssl-multirootca< 1.6.5-r20
cfssl-multirootca-fips< 1.6.5-r12
cfssl-newkey< 1.6.5-r20
cfssl-newkey-fips< 1.6.5-r12
cfssl-scan< 1.6.5-r20

Show all 199

Alpine1 product

go< 1.24.4-r0

2 vendors · 200 products · Showing 200 of 2509

References

21 links

go.dev/cl/679257ARTICLEFIX
go.dev/issue/73816ARTICLEREPORT
groups.google.com/g/golang-announce/c/ufZ8WpEsA3AARTICLEWEB
pkg.go.dev/vuln/GO-2025-3751Advisory
access.redhat.com/errata/RHSA-2025:10672Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2373305REPORT
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10672.jsonAdvisory
access.redhat.com/security/cve/CVE-2025-4673REPORT
www.cve.org/CVERecord?id=CVE-2025-4673AdvisoryREPORT

Show all 21 references

nvd.nist.gov/vuln/detail/CVE-2025-4673AdvisoryOval
access.redhat.com/errata/RHSA-2025:15406Advisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15406.jsonAdvisory
access.redhat.com/errata/RHSA-2025:15887Advisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15887.jsonAdvisory
access.redhat.com/errata/RHSA-2025:16432Advisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16432.jsonAdvisory
ubuntu.com/security/CVE-2025-4673REPORT
ubuntu.com/security/notices/USN-7574-1Advisory
security-tracker.debian.org/tracker/CVE-2025-4673Advisory
security.alpinelinux.org/vuln/CVE-2025-4673Advisory