net/http/cookiejar vulnerabilities

Latest net/http/cookiejar CVEs

Newest publication first

1. CVE-2023-45289 Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

   Published 2024-03-05

   Medium·CVSS 4.3 EPSS 1.1%

   When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorizati...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.