CVE-2024-45336
MediumSummary
The Go HTTP client drops sensitive headers (e.g., Authorization) after a cross-domain redirect, but may re-send them on a subsequent same-domain redirect, posing a potential data leak risk.
Risk Assessment
The organization may face unauthorized disclosure of sensitive headers if an attacker crafts a redirect chain (cross-domain then same-domain), potentially leading to token or credential theft.
Recommendation
Immediately update the Go library to a patched version (e.g., Go 1.23.2 or later) and review code for manual header handling during redirects.
Original NVD description (English source)
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the