Overview
A flaw was found in net/http. Handling Proxy-Authorization and Proxy-Authenticate headers during cross-origin redirects allows these headers to be inadvertently forwarded, potentially exposing sensitive authentication credentials. This flaw allows a network-based attacker to manipulate redirect responses, unintentionally exposing authentication details to unauthorized parties.
Vendor advisories
- RHSA-2025:10677 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2025-07-09 · advisory
- RHSA-2025:16432 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2025-09-23 · advisory
- RHSA-2025:10672 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2025-07-09 · advisory
- RHSA-2025:15406 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4) · released 2025-09-08 · advisory
- RHSA-2025:10676 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-07-09 · advisory
- RHSA-2025:15887 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-09-16 · advisory
- RHSA-2026:19350 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-05-19 · advisory
- RHSA-2025:10735 · Red Hat · fixed in: Red Hat OpenShift distributed tracing 3.6.0 · released 2025-07-09 · advisory
- RHSA-2025:10823 · Red Hat · fixed in: Red Hat OpenShift distributed tracing 3.6.0 · released 2025-07-10 · advisory
- Red Hat VEX · Moderate · affected: Cryostat 4, Custom Metric Autoscaler operator for Red Hat Openshift, Deployment Validation Operator, Fence Agents Remediation Operator, Gatekeeper 3, Kube Descheduler Operator, … · no fix planned: Cryostat 4, Custom Metric Autoscaler operator for Red Hat Openshift, Deployment Validation Operator, Fence Agents Remediation Operator, … · updated 2026-10-16 · vex
net/http: Sensitive headers not cleared on cross-origin redirect in net/http — rated Moderate by Red Hat. Released 2025-06-11, updated 2026-10-16.
Affected:
- Cryostat 4
- Custom Metric Autoscaler operator for Red Hat Openshift
- Deployment Validation Operator
- Fence Agents Remediation Operator
- Gatekeeper 3
- Kube Descheduler Operator
- Logging Subsystem for Red Hat OpenShift
- Logical Volume Manager Storage
- Machine Deletion Remediation Operator
- Migration Toolkit for Applications 7
- Migration Toolkit for Containers
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- Multicluster Global Hub
- Node HealthCheck Operator
- Node Maintenance Operator
- OpenShift API for Data Protection
- OpenShift Developer Tools and Services
- OpenShift Pipelines
- OpenShift Run Once Duration Override Operator
- OpenShift Secondary Scheduler Operator
- OpenShift Serverless
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Power monitoring for Red Hat OpenShift
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 6
- Red Hat Ceph Storage 7
- Red Hat Ceph Storage 8
- Red Hat Certification for Red Hat Enterprise Linux 8
- Red Hat Certification Program for Red Hat Enterprise Linux 9
- Red Hat Connectivity Link 1
- Red Hat Edge Manager preview
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
Fixed:
- Red Hat Enterprise Linux AppStream (v. 10)
- Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Enterprise Linux AppStream EUS (v.9.4)
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift distributed tracing 3.6.0
No fix planned:
- Cryostat 4
- Custom Metric Autoscaler operator for Red Hat Openshift
- Deployment Validation Operator
- Fence Agents Remediation Operator
- Gatekeeper 3
- Kube Descheduler Operator
- Logging Subsystem for Red Hat OpenShift
- Logical Volume Manager Storage
- Machine Deletion Remediation Operator
- Migration Toolkit for Applications 7
- Migration Toolkit for Containers
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- Multicluster Global Hub
- Node HealthCheck Operator
- Node Maintenance Operator
- OpenShift API for Data Protection
- OpenShift Developer Tools and Services
- OpenShift Pipelines
- OpenShift Run Once Duration Override Operator
- OpenShift Secondary Scheduler Operator
- OpenShift Serverless
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Power monitoring for Red Hat OpenShift
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 6
- Red Hat Ceph Storage 7
- Red Hat Ceph Storage 8
- Red Hat Certification for Red Hat Enterprise Linux 8
- Red Hat Certification Program for Red Hat Enterprise Linux 9
- Red Hat Connectivity Link 1
- Red Hat Edge Manager preview
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
Not affected:
- Red Hat OpenShift distributed tracing 3.6.0
Remediation
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:10677
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:16432
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:10672
Workarounds / mitigations:
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package advisory (CVE-2025-4673)
Affected packages:
stdlib >= 1.24.0-0, < 1.24.4
Patched in:
Source: https://osv.dev/vulnerability/GO-2025-3751