VDB
RHEA-2025:3039
RHEA-2025:3039
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhacm2/submariner-globalnet-rhel9@sha256:c6278150aba5359c6dd1eed354421347d3356c18bb7ba445348985edde57c692_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | * |
| Red Hat | rhacm2/subctl-rhel9@sha256:17919fa48313e3e3c50ed4ec6a7a83664eb62a237195701d6c36f34611ff7e1e_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, rhacm2/subctl-rhel9@sha256:17919fa48313e3e3c50ed4ec6a7a83664eb62a237195701d6c36f34611ff7e1e_arm64, * |
| Red Hat | rhacm2/lighthouse-agent-rhel9@sha256:30ec5310eb49a4b6636b043c3c44186aafdf80cdefb5bb83a193f2966bc438b9_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/lighthouse-agent-rhel9@sha256:30ec5310eb49a4b6636b043c3c44186aafdf80cdefb5bb83a193f2966bc438b9_ppc64le, *, * |
| Red Hat | rhacm2/submariner-globalnet-rhel9@sha256:f3356bf265f306ecb715ef6f2fb90b7b73067e97949c45d4ab18229555190130_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | * |
| Red Hat | rhacm2/subctl-rhel9@sha256:17919fa48313e3e3c50ed4ec6a7a83664eb62a237195701d6c36f34611ff7e1e_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | * |
| Red Hat | rhacm2/lighthouse-agent-rhel9@sha256:b216402f203d83592927c5e874eb340fb6753c1f734599be86d9023542d6aba1_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, rhacm2/lighthouse-agent-rhel9@sha256:b216402f203d83592927c5e874eb340fb6753c1f734599be86d9023542d6aba1_amd64, * |
| Red Hat | rhacm2/nettest-rhel9@sha256:28003d5647522aeff8a15bff9b5073604008900f8948c1760c506f1dce48c46f_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/nettest-rhel9@sha256:28003d5647522aeff8a15bff9b5073604008900f8948c1760c506f1dce48c46f_arm64 |
| Red Hat | rhacm2/submariner-route-agent-rhel9@sha256:ae0d074f3ea4edb5287bbf3a0ff9840b31dded19516dd063f1a357ad63c2f5ca_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/submariner-route-agent-rhel9@sha256:ae0d074f3ea4edb5287bbf3a0ff9840b31dded19516dd063f1a357ad63c2f5ca_amd64 |
| Red Hat | rhacm2/nettest-rhel9@sha256:7ef1393c01060bc26b0a48db41a3139e72ec138953f6e62b6c55c1e8e3a51fea_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/nettest-rhel9@sha256:7ef1393c01060bc26b0a48db41a3139e72ec138953f6e62b6c55c1e8e3a51fea_ppc64le, *, * |
| Red Hat | rhacm2/subctl-rhel9@sha256:0930e1895a3b6d40910b7d2ab8a57e49183065d9aae8d290a01f16f438ba9ec9_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/subctl-rhel9@sha256:0930e1895a3b6d40910b7d2ab8a57e49183065d9aae8d290a01f16f438ba9ec9_s390x, rhacm2/subctl-rhel9@sha256:0930e1895a3b6d40910b7d2ab8a57e49183065d9aae8d290a01f16f438ba9ec9_s390x, * |
| Red Hat | rhacm2/submariner-gateway-rhel9@sha256:55ed2a68e1ae7e27a125eca8849985f92614ea8eb8acc61233c9166de25cd705_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/submariner-gateway-rhel9@sha256:55ed2a68e1ae7e27a125eca8849985f92614ea8eb8acc61233c9166de25cd705_amd64 |
| Red Hat | rhacm2/submariner-gateway-rhel9@sha256:5c6f55c5fa1393933856e5de4737aab50a72550cd88f402e173ebc6199cad4e3_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/lighthouse-coredns-rhel9@sha256:0eef1850de8a8d0ae2b0a9452d347e3e0ac5fcce12c2a5af82d0304bf28ded16_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, rhacm2/lighthouse-coredns-rhel9@sha256:0eef1850de8a8d0ae2b0a9452d347e3e0ac5fcce12c2a5af82d0304bf28ded16_s390x, * |
| Red Hat | rhacm2/submariner-rhel9-operator@sha256:9270a07978b0ca5026e98d5fa70572f5c6726d0118ebf2288d5ee9f62dcb1a73_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | * |
| Red Hat | rhacm2/submariner-gateway-rhel9@sha256:5dffcc79a7d26ba681c9d105fed2410d28ab7b975892dcd2770ae90248f42777_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, rhacm2/submariner-gateway-rhel9@sha256:5dffcc79a7d26ba681c9d105fed2410d28ab7b975892dcd2770ae90248f42777_arm64, * |
| Red Hat | rhacm2/submariner-operator-bundle@sha256:4fff3a8e35cddb335e11a45b84c32de2790e62f0292fa7919b71fe2cfddd7d3a_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, rhacm2/submariner-operator-bundle@sha256:4fff3a8e35cddb335e11a45b84c32de2790e62f0292fa7919b71fe2cfddd7d3a_arm64, rhacm2/submariner-operator-bundle@sha256:4fff3a8e35cddb335e11a45b84c32de2790e62f0292fa7919b71fe2cfddd7d3a_arm64 |
| Red Hat | rhacm2/submariner-operator-bundle@sha256:3e35b075c312d0d2b58c8ebe4b0544ba65d6658a5a1c3f4f5993cfe628b1b9c2_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/submariner-operator-bundle@sha256:3e35b075c312d0d2b58c8ebe4b0544ba65d6658a5a1c3f4f5993cfe628b1b9c2_ppc64le, *, * |
| Red Hat | rhacm2/submariner-route-agent-rhel9@sha256:919c2e57a868427ef8530ba86196b3de7ae7e9da3fe10058acc1696b7e6c03d2_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, *, rhacm2/submariner-route-agent-rhel9@sha256:919c2e57a868427ef8530ba86196b3de7ae7e9da3fe10058acc1696b7e6c03d2_ppc64le |
| Red Hat | rhacm2/lighthouse-coredns-rhel9@sha256:ff102a7daf667880f5dc6c22d6d43ae6ed4300e2d8c78b41b90507efbcfa9f3e_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, rhacm2/lighthouse-coredns-rhel9@sha256:ff102a7daf667880f5dc6c22d6d43ae6ed4300e2d8c78b41b90507efbcfa9f3e_ppc64le, * |
| Red Hat | rhacm2/submariner-rhel9-operator@sha256:071aa7ca5fc4aee89b6b6174a6560d4571c3c9feaf80e44dfffa8dc0d02087fc_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/submariner-rhel9-operator@sha256:071aa7ca5fc4aee89b6b6174a6560d4571c3c9feaf80e44dfffa8dc0d02087fc_ppc64le |
…and 52 more
Timeline
- Mar 19, 2025 CVE Published
- Apr 25, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHEA-2025:3039 advisory
- https://issues.redhat.com/browse/ACM-17297 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2341751 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45336 advisory
- https://go.dev/cl/643735 advisory
- https://go.dev/issue/71383 advisory
- https://issues.redhat.com/browse/HYPBLD-614 advisory
- https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI advisory
- https://access.redhat.com/security/cve/CVE-2025-22866 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22866 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22866 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhea-2025_3039.json advisory
- https://github.com/golang/go/issues/70530 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45336 advisory
- https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k advisory
- https://pkg.go.dev/vuln/GO-2025-3447 advisory
- https://access.redhat.com/security/cve/CVE-2024-45336 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2344219 issue