GO-2025-3420

    Dashboard / Vulnerabilities / GO-2025-3420

    GO-2025-3420

    Published: 28 Jan 2025Last Modified: 17 Feb 2026

    Summary: Sensitive headers incorrectly sent after cross-domain redirect in net/http

    Details: The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

    References: https://go.dev/cl/643100, https://go.dev/issue/70530, https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ, https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ

    Affected packages

    Package

    Name: stdlib

    Purl: pkg:golang/stdlib

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.22.11

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GO-2025-3420 | CVE-DB