VDB
RHSA-2026:72737
RHSA-2026:72737
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | git-lfs-0:3.2.0-2.el8_8.8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | 3.2.0-2.el8, 3.2.0-2.el8, 3.2.0-2.el8 |
| Red Hat | git-lfs-0:3.2.0-2.el8_8.8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) | 3.2.0-2.el8, 3.2.0-2.el8, 3.2.0-2.el8 |
| Red Hat | git-lfs-debuginfo-0:3.2.0-2.el8_8.8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) | 3.2.0-2.el8, 3.2.0-2.el8, 3.2.0-2.el8 |
| Red Hat | git-lfs-debugsource-0:3.2.0-2.el8_8.8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) | 3.2.0-2.el8, 3.2.0-2.el8, 3.2.0-2.el8 |
| Red Hat | git-lfs-debuginfo-0:3.2.0-2.el8_8.8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | 3.2.0-2.el8, 3.2.0-2.el8, 3.2.0-2.el8 |
| Red Hat | git-lfs-0:3.2.0-2.el8_8.8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | 3.2.0-2.el8, 3.2.0-2.el8, 3.2.0-2.el8 |
| Red Hat | git-lfs-debugsource-0:3.2.0-2.el8_8.8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | 3.2.0-2.el8, 3.2.0-2.el8, 3.2.0-2.el8 |
| Red Hat | git-lfs-debuginfo-0:3.2.0-2.el8_8.8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | 3.2.0-2.el8, 3.2.0-2.el8, 3.2.0-2.el8 |
| Red Hat | git-lfs-0:3.2.0-2.el8_8.8.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) | 3.2.0-2.el8, 3.2.0-2.el8, 3.2.0-2.el8 |
| Red Hat | git-lfs-debugsource-0:3.2.0-2.el8_8.8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | 3.2.0-2.el8, 3.2.0-2.el8, 3.2.0-2.el8 |
| Red Hat | git-lfs-0:3.2.0-2.el8_8.8.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) | 3.2.0-2.el8, 3.2.0-2.el8, 3.2.0-2.el8 |
Timeline
- Sep 28, 2026 CVE Published
- Oct 15, 2026 CVE Updated
- Oct 15, 2026 Distribution Patch
- Oct 15, 2026 Distribution Patch
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:72737 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2341751 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2344219 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2437111 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456333 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456336 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456338 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456339 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467822 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484204 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515815 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515820 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515827 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515839 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72737.json advisory
- https://access.redhat.com/security/cve/CVE-2024-45336 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45336 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45336 advisory
…and 87 more