CVE-2024-45336

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

• https://go.dev/cl/643100
• https://go.dev/issue/70530
• https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
• https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ
• https://pkg.go.dev/vuln/GO-2025-3420
• https://security.netapp.com/advisory/ntap-20250221-0003/

Published

Jan 28, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45330A use of externally-controlled format string in Fortinet For…7.2
• CVE-2024-45331A incorrect privilege assignment vulnerability in Fortinet F…7.8
• CVE-2024-45332Exposure of sensitive information caused by shared microarch…5.7
• CVE-2024-45333Improper access control for some Intel(R) Data Center GPU Fl…7.3
• CVE-2024-45334Trend Micro Antivirus One versions 3.10.4 and below (Consume…7.8
• CVE-2024-45335Trend Micro Antivirus One, version 3.10.4 and below contains…5.5
• CVE-2024-45337Applications and libraries which misuse connection.serverAut…9.1
• CVE-2024-45338An attacker can craft an input to the Parse functions that w…5.3
• CVE-2024-45339When logs are written to a widely-writable directory (the de…7.1
• CVE-2024-4534The KKProgressbar2 Free WordPress plugin through 1.1.4.2 do…6.1
• CVE-2024-45340Credentials provided via the new GOAUTH feature were not bei…8.8
• CVE-2024-45341A certificate with a URI which has a IPv6 address with a zon…6.1