CVE-2024-45336 Sensitive headers incorrectly sent after cross-domain redirect in net/http
Go's HTTP client may leak sensitive headers to unintended domains after specific redirect chains, exposing credentials to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-45336?
CVE-2024-45336 is a medium-severity vulnerability in Go standard library net/http, published on 28 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
Which versions are affected by CVE-2024-45336?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.22.11, 1.23.5, 1.24.0 |
stdlib Go | All versions | 1.22.11, 1.23.5, 1.24.0-rc.2 |
Linux distribution packages (3)
rhc Red Hat:enterprise_linux:10.0 | All versions | 1:0.3.2-1.el10_0 |
rhc-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 1:0.3.2-1.el10_0 |
rhc-debugsource Red Hat:enterprise_linux:10.0 | All versions | 1:0.3.2-1.el10_0 |
How do I fix CVE-2024-45336?
Upgrade golang to a fixed version for your release line: 1.22.11, 1.23.5 or 1.24.0.
Is CVE-2024-45336 being exploited?
There is no known exploitation of CVE-2024-45336 in the wild and no public exploit code.
Sources
Also known as AZL-55998, AZL-56005, AZL-56058, AZL-78950, AZL-98790, BELL-CVE-2024-45336 and 27 more.