{"id":"EUVD-2025-18133","revision":"a634526672bb47429add18095b7f5684","records":[{"revision":"a634526672bb47429add18095b7f5684","observedAt":"2026-10-31T23:16:59.331+00:00","statement":{"source":"euvd","id":"EUVD-2025-18133","aliases":["CVE-2025-4673","GHSA-62jj-gr2r-5c34"],"title":"Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.","description":"Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","score":6.8,"severity":null}],"references":["https://go.dev/cl/679257","https://go.dev/issue/73816","https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A","https://pkg.go.dev/vuln/GO-2025-3751"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18133","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 11, 2025, 4:42:53 PM","dateUpdated":"Jun 11, 2025, 5:59:48 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2025:03158-1","title":"Security update for go1.24-openssl","vulnerabilityIds":["CVE-2025-0913","CVE-2025-22874","CVE-2025-4673","CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"RHSA-2026:19350","title":"Red Hat Security Advisory: git-lfs security update","vulnerabilityIds":["CVE-2024-45341","CVE-2025-4673","CVE-2025-47906","CVE-2026-25679","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-33810"]},{"id":"RHSA-2025:10677","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2025-4673","CVE-2025-22874"]},{"id":"SUSE-SU-2025:01846-1","title":"Security update for go1.24","vulnerabilityIds":["CVE-2025-0913","CVE-2025-22873","CVE-2025-22874","CVE-2025-4673"]},{"id":"SUSE-SU-2025:03159-1","title":"Security update for go1.23-openssl","vulnerabilityIds":["CVE-2024-45336","CVE-2024-45341","CVE-2025-0913","CVE-2025-22866","CVE-2025-22870","CVE-2025-22871","CVE-2025-4673","CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"RHSA-2025:10735","title":"Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.6.1 release","vulnerabilityIds":["CVE-2025-4673","CVE-2025-6020"]},{"id":"RHSA-2026:87245","title":"Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2024-45336","CVE-2025-4673","CVE-2025-22866","CVE-2025-22874","CVE-2025-68121","CVE-2026-27137","CVE-2026-27143","CVE-2026-27144","CVE-2026-27145","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-33810","CVE-2026-33811","CVE-2026-33814","CVE-2026-33818","CVE-2026-39820","CVE-2026-39821","CVE-2026-42499","CVE-2026-42504","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-56866","CVE-2026-78659","CVE-2026-78660","CVE-2026-78663","CVE-2026-78667","CVE-2026-78669","CVE-2026-94439","CVE-2026-94440","CVE-2026-94444","CVE-2026-94447","CVE-2026-94448","CVE-2026-97030","CVE-2026-97031","CVE-2026-97032","CVE-2026-111943"]},{"id":"openSUSE-SU-2025:15224-1","title":"go1.24-1.24.4-1.1 on GA media","vulnerabilityIds":["CVE-2025-0913","CVE-2025-22874","CVE-2025-4673"]},{"id":"RHSA-2025:10823","title":"Red Hat Security Advisory: Red Hat build of Tempo 3.6.1 release","vulnerabilityIds":["CVE-2025-4673","CVE-2025-6020"]},{"id":"RHSA-2025:15887","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-4673"]},{"id":"RHSA-2026:87246","title":"Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2024-45336","CVE-2025-4673","CVE-2025-22866","CVE-2025-22874","CVE-2025-68121","CVE-2026-27137","CVE-2026-27143","CVE-2026-27144","CVE-2026-27145","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-33810","CVE-2026-33811","CVE-2026-33814","CVE-2026-33818","CVE-2026-39820","CVE-2026-39821","CVE-2026-42499","CVE-2026-42504","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-56866","CVE-2026-78659","CVE-2026-78660","CVE-2026-78663","CVE-2026-78667","CVE-2026-78669","CVE-2026-94439","CVE-2026-94440","CVE-2026-94444","CVE-2026-94447","CVE-2026-94448","CVE-2026-97030","CVE-2026-97031","CVE-2026-97032","CVE-2026-111943"]},{"id":"RHSA-2025:16432","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-4673"]},{"id":"SUSE-SU-2026:4606-1","title":"Security update for golang-github-prometheus-prometheus","vulnerabilityIds":["CVE-2023-45289","CVE-2025-4673","CVE-2025-61686","CVE-2026-2303","CVE-2026-39821","CVE-2026-40181","CVE-2026-42211","CVE-2026-42342","CVE-2026-44990","CVE-2026-53606","CVE-2026-56852"]},{"id":"RHSA-2025:10672","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","vulnerabilityIds":["CVE-2025-4673"]},{"id":"openSUSE-SU-2025:15223-1","title":"go1.23-1.23.10-1.1 on GA media","vulnerabilityIds":["CVE-2025-0913","CVE-2025-4673"]},{"id":"SUSE-SU-2025:01848-1","title":"Security update for go1.23","vulnerabilityIds":["CVE-2025-0913","CVE-2025-4673"]},{"id":"openSUSE-SU-2026:11436-1","title":"golang-github-prometheus-prometheus-3.13.2-1.1 on GA media","vulnerabilityIds":["CVE-2023-45289","CVE-2025-4673","CVE-2026-44990","CVE-2026-56852"]},{"id":"RHSA-2025:10676","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2025-4673","CVE-2025-22874"]},{"id":"SUSE-SU-2026:4585-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2023-45289","CVE-2024-22195","CVE-2025-13836","CVE-2025-4673","CVE-2025-61686","CVE-2026-0864","CVE-2026-11940","CVE-2026-11972","CVE-2026-1229","CVE-2026-13346","CVE-2026-14199","CVE-2026-1502","CVE-2026-15308","CVE-2026-1703","CVE-2026-17033","CVE-2026-17183","CVE-2026-19197","CVE-2026-19475","CVE-2026-21723","CVE-2026-2303","CVE-2026-27459","CVE-2026-3219","CVE-2026-3276","CVE-2026-33814","CVE-2026-3446","CVE-2026-3479","CVE-2026-39821","CVE-2026-39882","CVE-2026-40181","CVE-2026-40475","CVE-2026-41066","CVE-2026-41178","CVE-2026-41606","CVE-2026-42127","CVE-2026-42211","CVE-2026-42342","CVE-2026-4360","CVE-2026-44431","CVE-2026-44990","CVE-2026-45409","CVE-2026-4786","CVE-2026-49825","CVE-2026-49853","CVE-2026-49854","CVE-2026-49855","CVE-2026-53606","CVE-2026-56852","CVE-2026-6019","CVE-2026-6100","CVE-2026-6357","CVE-2026-7210","CVE-2026-73501","CVE-2026-7774","CVE-2026-8328","CVE-2026-8595","CVE-2026-8609","CVE-2026-8643","CVE-2026-9029"]},{"id":"openSUSE-SU-2025:15225-1","title":"govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media","vulnerabilityIds":["CVE-2020-36846","CVE-2022-31022","CVE-2023-42818","CVE-2025-0913","CVE-2025-1792","CVE-2025-22874","CVE-2025-25207","CVE-2025-25208","CVE-2025-2571","CVE-2025-29785","CVE-2025-3230","CVE-2025-3260","CVE-2025-3454","CVE-2025-3611","CVE-2025-3913","CVE-2025-4128","CVE-2025-4573","CVE-2025-4673","CVE-2025-47950","CVE-2025-48494","CVE-2025-48495","CVE-2025-48710","CVE-2025-48865","CVE-2025-48938","CVE-2025-48948","CVE-2025-48949","CVE-2025-49011","CVE-2025-49136","CVE-2025-49140"]},{"id":"msrc_CVE-2025-4673","title":"Sensitive headers not cleared on cross-origin redirect in net/http","vulnerabilityIds":["CVE-2025-4673"]},{"id":"RHSA-2025:15406","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-4673"]},{"id":"SUSE-SU-2025:02120-1","title":"Security update for go1.24-openssl","vulnerabilityIds":["CVE-2025-0913","CVE-2025-22874","CVE-2025-4673"]},{"id":"WID-SEC-W-2025-1205","title":"Golang Go: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-0913","CVE-2025-22874","CVE-2025-4673"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-18133","identifiers":["EUVD-2025-18133","CVE-2025-4673","GHSA-62jj-gr2r-5c34"]},"retained":false,"historicalAffected":[]}],"coverage":[]}