CVE-2024-45336
mediumpriority · track · 0EPSS 0.007 · 54 %ileDEEUFRRUUSEPSS · scored 2026-10-27
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedgovulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedgovulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedgovulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedgovulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (49)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux Multicluster Engine for Kubernetesall versionscert_bundDEcpe:/o:redhat:enterprise_linux:multicluster_engine_for_kubernetes
advisories (6)
Vendor and ecosystem advisories describing this.
- SUSE-SU-2025:0297-1Security update for govulncheck-vulndb2025-01-30csaf · suse_csafDE
Security update for govulncheck-vulndb
- SUSE-SU-2025:0429-1Security update for govulncheck-vulndb2025-02-11csaf · suse_csafDE
Security update for govulncheck-vulndb
- WID-SEC-W-2025-0111Golang Go: Mehrere SchwachstellenDeutsch2025-01-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.
- BIT-golang-2024-45336Sensitive headers incorrectly sent after cross-domain redirect in net/http2025-01-30vendor · osvUS
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- GO-2025-3420Sensitive headers incorrectly sent after cross-domain redirect in net/http2025-01-28vendor · osvUS
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
also known as (6)
Other names and identifiers for this entity.
- CNNVD-202501-3923cnnvd
- EUVD-2024-41740enisa_euvd
- BDU:2025-02667fstec_bdu
- GHSA-7wrw-r4p8-38rxenisa_euvd
- BIT-golang-2024-45336osv
- GO-2025-3420osv
sources
Which sources assert this record, and when.
references (17)
External citations — patches, advisories, analysis.
- https://go.dev/cl/643100cnnvd
- https://go.dev/issue/70530cnnvd
- https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJcnnvd
- https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJcnnvd
- https://pkg.go.dev/vuln/GO-2025-3420cnnvd
- https://vigilance.fr/vulnerability/Go-two-vulnerabilities-dated-16-01-2025-46177cnnvd
- https://go.dev/cl/643100enisa_euvd
- https://go.dev/issue/70530enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan