What’s Vulnerable › Vulnerabilities

CVE-2024-45336: Sensitive headers incorrectly sent after cross-domain redirect in net/http

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-28 · updated 2026-06-17

Description

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

Affected products

• Go standard library net/http: before 1.22.11; from 1.23.0-0 before 1.23.5; from 1.24.0-0 before 1.24.0-rc.2 — fixed in 1.22.11, 1.23.5, 1.24.0-rc.2

How to fix

Upgrade to a fixed version: Go standard library net/http 1.22.11, 1.23.5, 1.24.0-rc.2. Check the vendor advisory for mitigations.

References

• https://go.dev/cl/643100
• https://go.dev/issue/70530
• https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
• https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ
• https://pkg.go.dev/vuln/GO-2025-3420
• https://security.netapp.com/advisory/ntap-20250221-0003/

Get alerted when CVE-2024-45336 or the next vulnerability affects your stack