VDB
RHSA-2025%3A4666
RHSA-2025%3A4666
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhacm2/insights-client-rhel9@sha256:393905442da85080af4a94ad0cd8eeabc41d839249bc950aa70ef98cfb035886_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/insights-client-rhel9@sha256:393905442da85080af4a94ad0cd8eeabc41d839249bc950aa70ef98cfb035886_arm64, *, * |
| Red Hat | rhacm2/multicluster-operators-channel-rhel9@sha256:6bf53d300a6cff8293b58567676e22778c2b4ab10ffb87147ec65fe4f8b0c46b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/multicluster-operators-channel-rhel9@sha256:6bf53d300a6cff8293b58567676e22778c2b4ab10ffb87147ec65fe4f8b0c46b_s390x, *, rhacm2/multicluster-operators-channel-rhel9@sha256:6bf53d300a6cff8293b58567676e22778c2b4ab10ffb87147ec65fe4f8b0c46b_s390x |
| Red Hat | rhacm2/multicluster-operators-channel-rhel9@sha256:f46f69bf3bd2e90a52261476df2df5b73f50b4f43de4fd25c5e8eeaca413c1db_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/multicluster-operators-channel-rhel9@sha256:f46f69bf3bd2e90a52261476df2df5b73f50b4f43de4fd25c5e8eeaca413c1db_arm64, *, rhacm2/multicluster-operators-channel-rhel9@sha256:f46f69bf3bd2e90a52261476df2df5b73f50b4f43de4fd25c5e8eeaca413c1db_arm64 |
| Red Hat | rhacm2/endpoint-monitoring-rhel9-operator@sha256:61cc4d21f1e24a1303eb9341ac021f6ab30985374820d35c293957888f2b2969_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/endpoint-monitoring-rhel9-operator@sha256:61cc4d21f1e24a1303eb9341ac021f6ab30985374820d35c293957888f2b2969_amd64, *, * |
| Red Hat | rhacm2/acm-search-v2-rhel9@sha256:95aae9c017a9809cae869a76d59f6d72f8754061ebb8d797c68f9474fc3b4d5b_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/acm-search-v2-rhel9@sha256:95aae9c017a9809cae869a76d59f6d72f8754061ebb8d797c68f9474fc3b4d5b_amd64, *, rhacm2/acm-search-v2-rhel9@sha256:95aae9c017a9809cae869a76d59f6d72f8754061ebb8d797c68f9474fc3b4d5b_amd64 |
| Red Hat | rhacm2/node-exporter-rhel9@sha256:ffde842f232450af8538e63dc74d9a303b57ba98aa4da40627ede05fd2135cc1_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, rhacm2/node-exporter-rhel9@sha256:ffde842f232450af8538e63dc74d9a303b57ba98aa4da40627ede05fd2135cc1_arm64, rhacm2/node-exporter-rhel9@sha256:ffde842f232450af8538e63dc74d9a303b57ba98aa4da40627ede05fd2135cc1_arm64 |
| Red Hat | rhacm2/insights-metrics-rhel9@sha256:82917aa911c3877a779f63126f413cce9e7c910ad4257b9e6030753d7a06d674_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/insights-metrics-rhel9@sha256:82917aa911c3877a779f63126f413cce9e7c910ad4257b9e6030753d7a06d674_ppc64le, *, rhacm2/insights-metrics-rhel9@sha256:82917aa911c3877a779f63126f413cce9e7c910ad4257b9e6030753d7a06d674_ppc64le |
| Red Hat | rhacm2/acm-prometheus-config-reloader-rhel9@sha256:3249de598939f928939f861aadc7e991f5cf68c901f45120dd906056595542a3_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/acm-prometheus-config-reloader-rhel9@sha256:3249de598939f928939f861aadc7e991f5cf68c901f45120dd906056595542a3_ppc64le, *, rhacm2/acm-prometheus-config-reloader-rhel9@sha256:3249de598939f928939f861aadc7e991f5cf68c901f45120dd906056595542a3_ppc64le |
| Red Hat | rhacm2/multicluster-operators-channel-rhel9@sha256:b0446d611fcaf8a55e1369e7a7ccb9ad350d975a1332069ddbe59eb9d530a22d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/multicluster-operators-channel-rhel9@sha256:b0446d611fcaf8a55e1369e7a7ccb9ad350d975a1332069ddbe59eb9d530a22d_ppc64le, rhacm2/multicluster-operators-channel-rhel9@sha256:b0446d611fcaf8a55e1369e7a7ccb9ad350d975a1332069ddbe59eb9d530a22d_ppc64le, rhacm2/multicluster-operators-channel-rhel9@sha256:b0446d611fcaf8a55e1369e7a7ccb9ad350d975a1332069ddbe59eb9d530a22d_ppc64le |
| Red Hat | rhacm2/kube-rbac-proxy-rhel9@sha256:cc11263bc748bd79febd1b837e07769d5c5f86b408be373b5738da2b24990076_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, rhacm2/kube-rbac-proxy-rhel9@sha256:cc11263bc748bd79febd1b837e07769d5c5f86b408be373b5738da2b24990076_s390x, rhacm2/kube-rbac-proxy-rhel9@sha256:cc11263bc748bd79febd1b837e07769d5c5f86b408be373b5738da2b24990076_s390x |
| Red Hat | rhacm2/grafana-dashboard-loader-rhel9@sha256:a8eaee40ad5dded88a9305c03c561c6abd34f0a37cb15e158b847819e34c8eef_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/grafana-dashboard-loader-rhel9@sha256:a8eaee40ad5dded88a9305c03c561c6abd34f0a37cb15e158b847819e34c8eef_s390x, rhacm2/grafana-dashboard-loader-rhel9@sha256:a8eaee40ad5dded88a9305c03c561c6abd34f0a37cb15e158b847819e34c8eef_s390x, * |
| Red Hat | rhacm2/insights-metrics-rhel9@sha256:652d4e64c15311e7224bfc61c281acab6437c13f76cdaf3aeb1653677eeff48d_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, *, rhacm2/insights-metrics-rhel9@sha256:652d4e64c15311e7224bfc61c281acab6437c13f76cdaf3aeb1653677eeff48d_arm64 |
| Red Hat | rhacm2/submariner-addon-rhel9@sha256:59c3198721c01d7f8a16a381e1857439e8e6365859cd7880c6db9b1dee2508c8_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/submariner-addon-rhel9@sha256:59c3198721c01d7f8a16a381e1857439e8e6365859cd7880c6db9b1dee2508c8_arm64, *, * |
| Red Hat | rhacm2/observatorium-rhel9-operator@sha256:cdc09f88c4f1d35269371ac8bc6be21be704872b2045b8627a7bb63d2f3f0b33_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, rhacm2/observatorium-rhel9-operator@sha256:cdc09f88c4f1d35269371ac8bc6be21be704872b2045b8627a7bb63d2f3f0b33_amd64, rhacm2/observatorium-rhel9-operator@sha256:cdc09f88c4f1d35269371ac8bc6be21be704872b2045b8627a7bb63d2f3f0b33_amd64 |
| Red Hat | rhacm2/acm-search-indexer-rhel9@sha256:1d71003dfac54727518fa4c8309de463197aac80ad90cbc1f1c80869136d00e8_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, *, rhacm2/acm-search-indexer-rhel9@sha256:1d71003dfac54727518fa4c8309de463197aac80ad90cbc1f1c80869136d00e8_s390x |
| Red Hat | rhacm2/acm-prometheus-config-reloader-rhel9@sha256:e5b568f9e6dd6438aac902282c65f9262a0753db449bc4deb812a52f9a8b78ad_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/acm-prometheus-config-reloader-rhel9@sha256:e5b568f9e6dd6438aac902282c65f9262a0753db449bc4deb812a52f9a8b78ad_amd64, *, * |
| Red Hat | rhacm2/memcached-exporter-rhel9@sha256:3ef3168a9011ce366b32af10ccd78880524a7359844449ea8c126aad6aad9c1a_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/memcached-exporter-rhel9@sha256:3ef3168a9011ce366b32af10ccd78880524a7359844449ea8c126aad6aad9c1a_ppc64le, rhacm2/memcached-exporter-rhel9@sha256:3ef3168a9011ce366b32af10ccd78880524a7359844449ea8c126aad6aad9c1a_ppc64le, rhacm2/memcached-exporter-rhel9@sha256:3ef3168a9011ce366b32af10ccd78880524a7359844449ea8c126aad6aad9c1a_ppc64le |
| Red Hat | rhacm2/acm-cluster-permission-rhel9@sha256:cce4d7638249c914f00444ab79ff756244fd37b14850e21c1214ee759e3df122_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/kube-state-metrics-rhel9@sha256:6c06705233b5f7c131f828e3da22999b9cff2316085a03fda1ce2c48ac81d21d_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/kube-state-metrics-rhel9@sha256:6c06705233b5f7c131f828e3da22999b9cff2316085a03fda1ce2c48ac81d21d_s390x, rhacm2/kube-state-metrics-rhel9@sha256:6c06705233b5f7c131f828e3da22999b9cff2316085a03fda1ce2c48ac81d21d_s390x, rhacm2/kube-state-metrics-rhel9@sha256:6c06705233b5f7c131f828e3da22999b9cff2316085a03fda1ce2c48ac81d21d_s390x |
| Red Hat | rhacm2/submariner-addon-rhel9@sha256:b12239e267c5d0965f0736fb4aeb3df38804cf680b192684f3593381eff60855_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/submariner-addon-rhel9@sha256:b12239e267c5d0965f0736fb4aeb3df38804cf680b192684f3593381eff60855_ppc64le, rhacm2/submariner-addon-rhel9@sha256:b12239e267c5d0965f0736fb4aeb3df38804cf680b192684f3593381eff60855_ppc64le, rhacm2/submariner-addon-rhel9@sha256:b12239e267c5d0965f0736fb4aeb3df38804cf680b192684f3593381eff60855_ppc64le |
…and 323 more
Timeline
- May 7, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:4666 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.11/html/release_notes/ advisory
- https://issues.redhat.com/browse/ACM-15050 advisory
- https://issues.redhat.com/browse/ACM-17312 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4666.json advisory
- https://access.redhat.com/security/cve/CVE-2024-45336 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2341751 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45336 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45336 advisory
- https://github.com/golang/go/issues/70530 advisory
- https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI advisory
- https://access.redhat.com/security/cve/CVE-2025-22866 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2344219 issue
- https://www.cve.org/CVERecord?id=CVE-2025-22866 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22866 advisory
- https://go.dev/cl/643735 advisory
- https://go.dev/issue/71383 advisory
- https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k advisory
- https://pkg.go.dev/vuln/GO-2025-3447 advisory
…and 21 more