CVE-2025-4673 is a vulnerability in the net/http package of the Go programming language where sensitive headers (Proxy-Authorization and Proxy-Authenticate) are not cleared on cross-origin redirects. This flaw can cause these headers to be inadvertently forwarded to unauthorized parties if a network attacker manipulates redirect responses. Exploitation requires a proxy that uses these headers for authentication and user interaction with a malicious URL. The vulnerability impacts confidentiality but not integrity or availability. Red Hat's advisory for their OpenTelemetry build (version 3.6.1) includes this fix, but no official patch or mitigation is currently available that meets Red Hat's deployment and stability criteria.

The vulnerability can lead to significant confidentiality compromise by exposing sensitive authentication credentials during cross-origin redirects. However, the attack complexity is high, requiring specific proxy configurations and user interaction. There is no impact on system integrity or availability, and no arbitrary code execution is possible. Red Hat rates the issue as Moderate severity.

Red Hat currently does not provide a mitigation or patch that meets their criteria for ease of use, deployment, applicability, or stability. Users are advised to monitor Red Hat advisories for updates. No immediate workaround is available. Upgrading to a fixed version when released is recommended once available.