CVE-2025-4673: 
Go vulnerability analysis and mitigation

CVE-2025-4673 is an information disclosure vulnerability in Go's net/http standard library where Proxy-Authorization and Proxy-Authenticate headers are incorrectly persisted across cross-origin redirects, potentially leaking sensitive proxy credentials to unintended third-party servers. The vulnerability affects Go versions before 1.23.10 and versions 1.24.0 through 1.24.3 (fixed in 1.24.4). It was disclosed on June 11, 2025, by the Go security team. The CVSS v3.1 base score is 6.8 (Medium), though the scope is marked as Changed with High confidentiality impact (Red Hat CVE, Go Vuln DB, ENISA EUVD).

The root cause is improper handling of sensitive HTTP headers during redirect processing in Go's net/http package (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). When an HTTP client follows a redirect from one origin to a different origin, the library fails to strip Proxy-Authorization and Proxy-Authenticate headers before forwarding the request to the new destination. This means that proxy credentials — which are intended only for the original proxy server — are transmitted to the redirect target, which may be an attacker-controlled or otherwise untrusted server. The issue was tracked in the Go issue tracker as golang/go#73816 and fixed via code change CL 679257 (Go Announce, Go Vuln DB).

Successful exploitation results in the unintended disclosure of proxy authentication credentials (Proxy-Authorization header values, which typically contain Base64-encoded usernames and passwords) to cross-origin redirect targets. This is a confidentiality-only impact — there is no integrity or availability impact — but leaked proxy credentials could enable an attacker to authenticate to internal proxy infrastructure, pivot to internal network resources, or harvest credentials for further attacks. Applications that use Go's net/http client through authenticated proxies and follow redirects to external or attacker-controlled URLs are most at risk (Go Vuln DB, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.03% (0.000300), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to control or influence a redirect target that the victim's Go HTTP client will follow while using an authenticated proxy — a scenario that requires some degree of attacker positioning (Go Announce, ENISA EUVD).

1. Identify a target application: Find a Go application that uses net/http (versions < 1.23.10 or 1.24.0–1.24.3) to make HTTP requests through an authenticated proxy (i.e., the client sends Proxy-Authorization headers).
2. Control or influence a redirect: Position an attacker-controlled server or manipulate a web service to issue an HTTP redirect (e.g., 301/302) from the original request URL to an attacker-controlled cross-origin URL.
3. Trigger the redirect: Cause the vulnerable Go HTTP client to make a request to a URL that will redirect to the attacker's server — for example, by influencing user-supplied URLs, webhook targets, or SSRF-vulnerable endpoints in the application.
4. Capture the leaked headers: On the attacker-controlled server, log all incoming HTTP request headers. Due to the vulnerability, the Proxy-Authorization header from the original request will be forwarded to the attacker's server.
5. Decode and reuse credentials: Decode the Base64-encoded credentials from the Proxy-Authorization header (format: Basic base64(username:password)) and use them to authenticate to the victim's proxy infrastructure for further access (Go Vuln DB, Go Issue).

• Network: Outbound HTTP requests from Go-based applications to unexpected cross-origin destinations that include a Proxy-Authorization header; HTTP redirects (301/302) from expected endpoints to unfamiliar or external domains.
• Logs: Application or proxy logs showing Proxy-Authorization headers being sent to non-proxy (direct) destinations; HTTP client logs recording redirect chains that cross origin boundaries while retaining authentication headers.
• Application Behavior: Go HTTP clients following redirects to domains outside the expected set of trusted origins while proxy authentication is configured.

The Go team has released patched versions Go 1.23.10 and Go 1.24.4, which strip Proxy-Authorization and Proxy-Authenticate headers on cross-origin redirects. All users of affected versions should upgrade immediately. As a workaround prior to patching, applications can implement a custom http.Client with a CheckRedirect function that explicitly removes sensitive proxy headers before following cross-origin redirects. Downstream distributions including Red Hat, Ubuntu (USN-7574-1), Arch Linux (ASA-202506-4), openSUSE, Mageia, and Amazon Linux 2 have also released updated packages (Go Announce, Ubuntu Advisory, Red Hat Errata, Arch Advisory).

The Go team announced the fix via the official golang-announce mailing list and Bluesky on June 6, 2025, alongside fixes for two other security issues in the same release (Go Announce). The vulnerability was also disclosed on the oss-security mailing list. Security news outlets such as SecurityOnline.info covered the release, noting that Go fixed three security flaws in the update. Community discussion on Reddit's CVEWatch subreddit listed it among trending CVEs in the days following disclosure. Broadcom, Splunk, IBM, and Azure AKS have all issued advisories or updated their products in response to this vulnerability, reflecting its broad impact across the Go ecosystem.