CVE-2025-4673: Go Standard Library Net/http

Medium severity, CVSS 6.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

Affected products

• Go Standard Library Net/http: before 1.23.10 (fixed in 1.23.10); from 1.24.0-0, before 1.24.4 (fixed in 1.24.4)

Published 2025-06-11. Last modified 2026-06-17.