Go net/http Proxy Header Leakage Vulnerability on Cross-Origin Redirects

A vulnerability exists in the Go programming language's net/http standard library, specifically in versions prior to 1.23.10 and between 1.24.0-0 and 1.24.4. This vulnerability involves the improper handling of Proxy-Authorization and Proxy-Authenticate headers during cross-origin redirects, which could lead to the unintentional leakage of sensitive information.

Impact

Exploitation of this vulnerability could result in the unauthorized disclosure of sensitive information through leaked proxy headers.

Remediation

Users can upgrade to Go versions 1.24.4 or 1.23.10 to address this vulnerability.