EUVD-2025-18133Published

Sensitive headers not cleared on cross-origin redirect in net/http

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2025-4673

Published

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

Source published: 11 Jun 2025 16:42:53 UTC
Source modified: 11 Jun 2025 17:59:48 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

euvd · EUVD-2025-18133

Published

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jun 11, 2025, 4:42:53 PM

dateUpdated: Jun 11, 2025, 5:59:48 PM

24 related source bulletins · separate from aliases

SUSE-SU-2025:03158-1: Security update for go1.24-openssl

CVE-2025-0913 · CVE-2025-22874 · CVE-2025-4673 · CVE-2025-4674 · CVE-2025-47906 · CVE-2025-47907

RHSA-2026:19350: Red Hat Security Advisory: git-lfs security update

CVE-2024-45341 · CVE-2025-4673 · CVE-2025-47906 · CVE-2026-25679 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-32283 · CVE-2026-33810

RHSA-2025:10677: Red Hat Security Advisory: golang security update

CVE-2025-4673 · CVE-2025-22874

SUSE-SU-2025:01846-1: Security update for go1.24

CVE-2025-0913 · CVE-2025-22873 · CVE-2025-22874 · CVE-2025-4673

SUSE-SU-2025:03159-1: Security update for go1.23-openssl

CVE-2024-45336 · CVE-2024-45341 · CVE-2025-0913 · CVE-2025-22866 · CVE-2025-22870 · CVE-2025-22871 · CVE-2025-4673 · CVE-2025-4674 · CVE-2025-47906 · CVE-2025-47907

RHSA-2025:10735: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.6.1 release

CVE-2025-4673 · CVE-2025-6020

RHSA-2026:87245: Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update

CVE-2024-45336 · CVE-2025-4673 · CVE-2025-22866 · CVE-2025-22874 · CVE-2025-68121 · CVE-2026-27137 · CVE-2026-27143 · CVE-2026-27144 · CVE-2026-27145 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-32283 · CVE-2026-33810 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-33818 · CVE-2026-39820 · CVE-2026-39821 · CVE-2026-42499 · CVE-2026-42504 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-56866 · CVE-2026-78659 · CVE-2026-78660 · CVE-2026-78663 · CVE-2026-78667 · CVE-2026-78669 · CVE-2026-94439 · CVE-2026-94440 · CVE-2026-94444 · CVE-2026-94447 · CVE-2026-94448 · CVE-2026-97030 · CVE-2026-97031 · CVE-2026-97032 · CVE-2026-111943

openSUSE-SU-2025:15224-1: go1.24-1.24.4-1.1 on GA media

CVE-2025-0913 · CVE-2025-22874 · CVE-2025-4673

RHSA-2025:10823: Red Hat Security Advisory: Red Hat build of Tempo 3.6.1 release

CVE-2025-4673 · CVE-2025-6020

RHSA-2025:15887: Red Hat Security Advisory: opentelemetry-collector security update

CVE-2025-4673

RHSA-2026:87246: Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update

RHSA-2025:16432: Red Hat Security Advisory: opentelemetry-collector security update

CVE-2025-4673

SUSE-SU-2026:4606-1: Security update for golang-github-prometheus-prometheus

CVE-2023-45289 · CVE-2025-4673 · CVE-2025-61686 · CVE-2026-2303 · CVE-2026-39821 · CVE-2026-40181 · CVE-2026-42211 · CVE-2026-42342 · CVE-2026-44990 · CVE-2026-53606 · CVE-2026-56852

RHSA-2025:10672: Red Hat Security Advisory: go-toolset:rhel8 security update

CVE-2025-4673

openSUSE-SU-2025:15223-1: go1.23-1.23.10-1.1 on GA media

CVE-2025-0913 · CVE-2025-4673

SUSE-SU-2025:01848-1: Security update for go1.23

CVE-2025-0913 · CVE-2025-4673

openSUSE-SU-2026:11436-1: golang-github-prometheus-prometheus-3.13.2-1.1 on GA media

CVE-2023-45289 · CVE-2025-4673 · CVE-2026-44990 · CVE-2026-56852

RHSA-2025:10676: Red Hat Security Advisory: golang security update

CVE-2025-4673 · CVE-2025-22874

SUSE-SU-2026:4585-1: Security update 5.2.1 for Multi-Linux Manager Client Tools

CVE-2023-45289 · CVE-2024-22195 · CVE-2025-13836 · CVE-2025-4673 · CVE-2025-61686 · CVE-2026-0864 · CVE-2026-11940 · CVE-2026-11972 · CVE-2026-1229 · CVE-2026-13346 · CVE-2026-14199 · CVE-2026-1502 · CVE-2026-15308 · CVE-2026-1703 · CVE-2026-17033 · CVE-2026-17183 · CVE-2026-19197 · CVE-2026-19475 · CVE-2026-21723 · CVE-2026-2303 · CVE-2026-27459 · CVE-2026-3219 · CVE-2026-3276 · CVE-2026-33814 · CVE-2026-3446 · CVE-2026-3479 · CVE-2026-39821 · CVE-2026-39882 · CVE-2026-40181 · CVE-2026-40475 · CVE-2026-41066 · CVE-2026-41178 · CVE-2026-41606 · CVE-2026-42127 · CVE-2026-42211 · CVE-2026-42342 · CVE-2026-4360 · CVE-2026-44431 · CVE-2026-44990 · CVE-2026-45409 · CVE-2026-4786 · CVE-2026-49825 · CVE-2026-49853 · CVE-2026-49854 · CVE-2026-49855 · CVE-2026-53606 · CVE-2026-56852 · CVE-2026-6019 · CVE-2026-6100 · CVE-2026-6357 · CVE-2026-7210 · CVE-2026-73501 · CVE-2026-7774 · CVE-2026-8328 · CVE-2026-8595 · CVE-2026-8609 · CVE-2026-8643 · CVE-2026-9029

openSUSE-SU-2025:15225-1: govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media

CVE-2020-36846 · CVE-2022-31022 · CVE-2023-42818 · CVE-2025-0913 · CVE-2025-1792 · CVE-2025-22874 · CVE-2025-25207 · CVE-2025-25208 · CVE-2025-2571 · CVE-2025-29785 · CVE-2025-3230 · CVE-2025-3260 · CVE-2025-3454 · CVE-2025-3611 · CVE-2025-3913 · CVE-2025-4128 · CVE-2025-4573 · CVE-2025-4673 · CVE-2025-47950 · CVE-2025-48494 · CVE-2025-48495 · CVE-2025-48710 · CVE-2025-48865 · CVE-2025-48938 · CVE-2025-48948 · CVE-2025-48949 · CVE-2025-49011 · CVE-2025-49136 · CVE-2025-49140

msrc_CVE-2025-4673: Sensitive headers not cleared on cross-origin redirect in net/http

CVE-2025-4673

RHSA-2025:15406: Red Hat Security Advisory: opentelemetry-collector security update

CVE-2025-4673

SUSE-SU-2025:02120-1: Security update for go1.24-openssl

CVE-2025-0913 · CVE-2025-22874 · CVE-2025-4673

WID-SEC-W-2025-1205: Golang Go: Mehrere Schwachstellen

CVE-2025-0913 · CVE-2025-22874 · CVE-2025-4673

Source published: Jun 11, 2025, 4:42:53 PM (timezone not stated)
Source modified: Jun 11, 2025, 5:59:48 PM (timezone not stated)
Observed here: 9 Nov 2026 03:05:00 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

nvd · CVE-2025-4673

Published

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Original publisher date fields

published: 2025-06-11T17:15:42.993

lastModified: 2026-06-17T09:33:45.897

Source published: 11 Jun 2025 17:15:42 UTC
Source modified: 17 Jun 2026 09:33:45 UTC
Observed here: 25 Oct 2026 02:24:54 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary · 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

osv · GO-2025-3751

Published

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

Source published: 11 Jun 2025 16:23:58 UTC
Source modified: 14 Oct 2026 10:57:00 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.