{"id":"EUVD-2025-18133","revision":null,"records":[{"revision":"8a45e258f72741a2914ce6d509792498","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-4673","aliases":[],"title":"Sensitive headers not cleared on cross-origin redirect in net/http","description":"Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.","state":0,"publishedAt":"2025-06-11T16:42:53.054+00:00","modifiedAt":"2025-06-11T17:59:48.033+00:00","affected":[{"ecosystem":"https://pkg.go.dev","name":"net/http","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Go standard library\",\n                    \"product\": \"net/http\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"net/http\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.23.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"1.24.0-0\",\n                            \"lessThan\": \"1.24.4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Client.makeHeadersCopier\"\n                        },\n                        {\n                            \"name\": \"Client.Do\"\n                        },\n                        {\n                            \"name\": \"Client.Get\"\n                        },\n                        {\n                            \"name\": \"Client.Head\"\n                        },\n                        {\n                            \"name\": \"Client.Post\"\n                        },\n                        {\n                            \"name\": \"Client.PostForm\"\n                        },\n                        {\n                            \"name\": \"Get\"\n                        },\n                        {\n                            \"name\": \"Head\"\n                        },\n                        {\n                            \"name\": \"Post\"\n                        },\n                        {\n                            \"name\": \"PostForm\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://go.dev/cl/679257","https://go.dev/issue/73816","https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A","https://pkg.go.dev/vuln/GO-2025-3751"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-4673","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-4673","identifiers":["CVE-2025-4673"]},"retained":false,"historicalAffected":[]},{"revision":"0ff9247d003c4f05a8d0b426c8802464","observedAt":"2026-11-09T03:05:00.401+00:00","statement":{"source":"euvd","id":"EUVD-2025-18133","aliases":["CVE-2025-4673","GHSA-62jj-gr2r-5c34"],"title":"Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.","description":"Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","score":6.8,"severity":null}],"references":["https://go.dev/cl/679257","https://go.dev/issue/73816","https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A","https://pkg.go.dev/vuln/GO-2025-3751"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18133","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 11, 2025, 4:42:53 PM","dateUpdated":"Jun 11, 2025, 5:59:48 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2025:03158-1","title":"Security update for go1.24-openssl","vulnerabilityIds":["CVE-2025-0913","CVE-2025-22874","CVE-2025-4673","CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"RHSA-2026:19350","title":"Red Hat Security Advisory: git-lfs security update","vulnerabilityIds":["CVE-2024-45341","CVE-2025-4673","CVE-2025-47906","CVE-2026-25679","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-33810"]},{"id":"RHSA-2025:10677","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2025-4673","CVE-2025-22874"]},{"id":"SUSE-SU-2025:01846-1","title":"Security update for go1.24","vulnerabilityIds":["CVE-2025-0913","CVE-2025-22873","CVE-2025-22874","CVE-2025-4673"]},{"id":"SUSE-SU-2025:03159-1","title":"Security update for go1.23-openssl","vulnerabilityIds":["CVE-2024-45336","CVE-2024-45341","CVE-2025-0913","CVE-2025-22866","CVE-2025-22870","CVE-2025-22871","CVE-2025-4673","CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"RHSA-2025:10735","title":"Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.6.1 release","vulnerabilityIds":["CVE-2025-4673","CVE-2025-6020"]},{"id":"RHSA-2026:87245","title":"Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2024-45336","CVE-2025-4673","CVE-2025-22866","CVE-2025-22874","CVE-2025-68121","CVE-2026-27137","CVE-2026-27143","CVE-2026-27144","CVE-2026-27145","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-33810","CVE-2026-33811","CVE-2026-33814","CVE-2026-33818","CVE-2026-39820","CVE-2026-39821","CVE-2026-42499","CVE-2026-42504","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-56866","CVE-2026-78659","CVE-2026-78660","CVE-2026-78663","CVE-2026-78667","CVE-2026-78669","CVE-2026-94439","CVE-2026-94440","CVE-2026-94444","CVE-2026-94447","CVE-2026-94448","CVE-2026-97030","CVE-2026-97031","CVE-2026-97032","CVE-2026-111943"]},{"id":"openSUSE-SU-2025:15224-1","title":"go1.24-1.24.4-1.1 on GA media","vulnerabilityIds":["CVE-2025-0913","CVE-2025-22874","CVE-2025-4673"]},{"id":"RHSA-2025:10823","title":"Red Hat Security Advisory: Red Hat build of Tempo 3.6.1 release","vulnerabilityIds":["CVE-2025-4673","CVE-2025-6020"]},{"id":"RHSA-2025:15887","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-4673"]},{"id":"RHSA-2026:87246","title":"Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2024-45336","CVE-2025-4673","CVE-2025-22866","CVE-2025-22874","CVE-2025-68121","CVE-2026-27137","CVE-2026-27143","CVE-2026-27144","CVE-2026-27145","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-33810","CVE-2026-33811","CVE-2026-33814","CVE-2026-33818","CVE-2026-39820","CVE-2026-39821","CVE-2026-42499","CVE-2026-42504","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-56866","CVE-2026-78659","CVE-2026-78660","CVE-2026-78663","CVE-2026-78667","CVE-2026-78669","CVE-2026-94439","CVE-2026-94440","CVE-2026-94444","CVE-2026-94447","CVE-2026-94448","CVE-2026-97030","CVE-2026-97031","CVE-2026-97032","CVE-2026-111943"]},{"id":"RHSA-2025:16432","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-4673"]},{"id":"SUSE-SU-2026:4606-1","title":"Security update for golang-github-prometheus-prometheus","vulnerabilityIds":["CVE-2023-45289","CVE-2025-4673","CVE-2025-61686","CVE-2026-2303","CVE-2026-39821","CVE-2026-40181","CVE-2026-42211","CVE-2026-42342","CVE-2026-44990","CVE-2026-53606","CVE-2026-56852"]},{"id":"RHSA-2025:10672","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","vulnerabilityIds":["CVE-2025-4673"]},{"id":"openSUSE-SU-2025:15223-1","title":"go1.23-1.23.10-1.1 on GA media","vulnerabilityIds":["CVE-2025-0913","CVE-2025-4673"]},{"id":"SUSE-SU-2025:01848-1","title":"Security update for go1.23","vulnerabilityIds":["CVE-2025-0913","CVE-2025-4673"]},{"id":"openSUSE-SU-2026:11436-1","title":"golang-github-prometheus-prometheus-3.13.2-1.1 on GA media","vulnerabilityIds":["CVE-2023-45289","CVE-2025-4673","CVE-2026-44990","CVE-2026-56852"]},{"id":"RHSA-2025:10676","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2025-4673","CVE-2025-22874"]},{"id":"SUSE-SU-2026:4585-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2023-45289","CVE-2024-22195","CVE-2025-13836","CVE-2025-4673","CVE-2025-61686","CVE-2026-0864","CVE-2026-11940","CVE-2026-11972","CVE-2026-1229","CVE-2026-13346","CVE-2026-14199","CVE-2026-1502","CVE-2026-15308","CVE-2026-1703","CVE-2026-17033","CVE-2026-17183","CVE-2026-19197","CVE-2026-19475","CVE-2026-21723","CVE-2026-2303","CVE-2026-27459","CVE-2026-3219","CVE-2026-3276","CVE-2026-33814","CVE-2026-3446","CVE-2026-3479","CVE-2026-39821","CVE-2026-39882","CVE-2026-40181","CVE-2026-40475","CVE-2026-41066","CVE-2026-41178","CVE-2026-41606","CVE-2026-42127","CVE-2026-42211","CVE-2026-42342","CVE-2026-4360","CVE-2026-44431","CVE-2026-44990","CVE-2026-45409","CVE-2026-4786","CVE-2026-49825","CVE-2026-49853","CVE-2026-49854","CVE-2026-49855","CVE-2026-53606","CVE-2026-56852","CVE-2026-6019","CVE-2026-6100","CVE-2026-6357","CVE-2026-7210","CVE-2026-73501","CVE-2026-7774","CVE-2026-8328","CVE-2026-8595","CVE-2026-8609","CVE-2026-8643","CVE-2026-9029"]},{"id":"openSUSE-SU-2025:15225-1","title":"govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media","vulnerabilityIds":["CVE-2020-36846","CVE-2022-31022","CVE-2023-42818","CVE-2025-0913","CVE-2025-1792","CVE-2025-22874","CVE-2025-25207","CVE-2025-25208","CVE-2025-2571","CVE-2025-29785","CVE-2025-3230","CVE-2025-3260","CVE-2025-3454","CVE-2025-3611","CVE-2025-3913","CVE-2025-4128","CVE-2025-4573","CVE-2025-4673","CVE-2025-47950","CVE-2025-48494","CVE-2025-48495","CVE-2025-48710","CVE-2025-48865","CVE-2025-48938","CVE-2025-48948","CVE-2025-48949","CVE-2025-49011","CVE-2025-49136","CVE-2025-49140"]},{"id":"msrc_CVE-2025-4673","title":"Sensitive headers not cleared on cross-origin redirect in net/http","vulnerabilityIds":["CVE-2025-4673"]},{"id":"RHSA-2025:15406","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-4673"]},{"id":"SUSE-SU-2025:02120-1","title":"Security update for go1.24-openssl","vulnerabilityIds":["CVE-2025-0913","CVE-2025-22874","CVE-2025-4673"]},{"id":"WID-SEC-W-2025-1205","title":"Golang Go: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-0913","CVE-2025-22874","CVE-2025-4673"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-18133","identifiers":["EUVD-2025-18133","CVE-2025-4673","GHSA-62jj-gr2r-5c34"]},"retained":false,"historicalAffected":[]},{"revision":"57d5842f1e0343a785d0639d60cc3805","observedAt":"2026-10-25T02:24:54.05+00:00","statement":{"source":"nvd","id":"CVE-2025-4673","aliases":[],"title":"Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.","description":"Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.","state":0,"publishedAt":"2025-06-11T17:15:42.993+00:00","modifiedAt":"2026-06-17T09:33:45.897+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","score":6.8,"severity":"MEDIUM"}],"references":["https://go.dev/cl/679257","https://go.dev/issue/73816","https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A","https://pkg.go.dev/vuln/GO-2025-3751"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-4673","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":[],"productCriteria":[],"sourceDates":{"published":"2025-06-11T17:15:42.993","lastModified":"2026-06-17T09:33:45.897"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-4673","identifiers":["CVE-2025-4673"]},"retained":false,"historicalAffected":[]},{"revision":"63b558211277414a8a61956e960e6a74","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-3751","aliases":["BIT-golang-2025-4673","CVE-2025-4673"],"title":"Sensitive headers not cleared on cross-origin redirect in net/http","description":"Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.","state":0,"publishedAt":"2025-06-11T16:23:58+00:00","modifiedAt":"2026-10-14T10:57:00.2304396+00:00","affected":[{"ecosystem":"Go","name":"stdlib","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.23.10"},{"kind":"introduced","version":"1.24.0-0"},{"kind":"fixed","version":"1.24.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://go.dev/cl/679257","https://go.dev/issue/73816","https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-3751","license":"OSV · upstream source license applies","key":"osv:GO-2025-3751","identifiers":["GO-2025-3751","BIT-golang-2025-4673","CVE-2025-4673"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T05:04:17.0540934+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T05:04:17.0540934+00:00","lastSuccessAt":"2026-11-10T05:04:18.9657904+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:04:18.9657907+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-77fffadfbb8fd9043950d68e58e30483f52900409642c6b646065548479c26cc","complete":true,"records":421868,"lastAttemptAt":"2026-11-10T05:02:16.4823631+00:00","lastSuccessAt":"2026-11-10T05:02:16.4560546+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:02:16.4823631+00:00","snapshotPublishedAt":"2026-11-10T04:28:56+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-a6dc967b5ceb4c488191e8f172ded5d6","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T05:06:09.4504083+00:00","lastSuccessAt":"2026-11-10T03:04:49.903+00:00","error":null,"lastVerifiedAt":"2026-11-10T03:04:49.903+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T05:04:17.0540934+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T05:04:17.0540934+00:00","lastSuccessAt":"2026-11-10T05:04:18.9669147+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:04:18.9669149+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0cb393c0854647ceaeade74220bf537d","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T05:06:08.8352765+00:00","lastSuccessAt":"2026-11-10T05:06:08.831+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T05:06:08.831+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T05:04:16.277674+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:04:16.277674+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T05:02:16.7857429+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:02:16.7857429+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-761ecc9061239b0da572dc9254c6f384c1d19339eb08408c436647a2f26129e9","complete":true,"records":3064,"lastAttemptAt":"2026-11-10T05:04:16.6684448+00:00","lastSuccessAt":"2026-11-09T17:05:03.4044794+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:04:16.6684448+00:00","snapshotPublishedAt":"2026-11-09T16:33:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-df80ce3f4ee69a086fc0f8e2d917e586081af2af4d81ef20f64f97855436e748","complete":true,"records":231583,"lastAttemptAt":"2026-11-10T05:04:16.1480624+00:00","lastSuccessAt":"2026-11-10T05:04:14.7294031+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:04:16.1480624+00:00","snapshotPublishedAt":"2026-11-10T04:33:09+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}