CVE-2024-45336 Details
Description
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
A vulnerability exists in the Go programming language's HTTP client, where sensitive headers, such as Authorization, are dropped after following a cross-domain redirect. This issue is present in Go versions through 1.22.10, 1.23.0-0 prior to 1.23.5, and 1.24.0-0 prior to 1.24.0-rc.2. The vulnerability can be reproduced by sending a request with an Authorization header to a domain that redirects to another domain. The header will not be sent to the final domain. However, if there is a same-domain redirect afterwards, the header will be restored, potentially leading to it being sent to the wrong domain.
Users can upgrade to Go versions 1.24.0-rc.2 or 1.23.5, both of which include the necessary fix. Instructions for downloading these versions are available on the Go website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 28, 2025CISA-ADP
Assessed Jan 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20250221-0003/ | CVE | AdvisoryVendor |
| https://go.dev/cl/643100 | [email protected] | Source CodeVendor |
| https://go.dev/issue/70530 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ | [email protected] | Mailing List |
| https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ | [email protected] | Mailing ListRemedyVendor |
| https://pkg.go.dev/vuln/GO-2025-3420 | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| golang | All versions |
CPE
Remediation
| |
| NetApp | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 21, 2025 | CVE Modified | CVE |
| Jan 28, 2025 | CVE Modified | CISA-ADP |
| Jan 28, 2025 | New CVE Received | [email protected] |