News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2025-4673 CVE Medium · CVSS 6.8 Medium Impact

net/http: Proxy Header Leak on Cross-Origin Redirects

Exploitable under specific conditions

This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

Affects deployments where KrakenD follows HTTP redirects from backends that redirect to a different origin, and where proxy authentication headers are present in the outbound upstream requests.

Component

Go standard library (net/http)

Disclosed

Jun 19, 2025

CVSS Score

6.8

Description

Go’s net/http client retains Proxy-Authorization and Proxy-Authenticate headers when following HTTP redirects to a different origin. If a backend reachable through KrakenD issues a cross-origin redirect and the upstream request carries proxy authentication headers, those credentials are forwarded to the redirect target. Fixed in Go 1.24.4.

Version summary

Community Edition

2.10.1

addresses this advisory

Affected CE versions

>= 2.0, < 2.10.1

Enterprise Edition

2.10.1

addresses this advisory

Affected EE versions

>= 2.0, < 2.10.1

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2025-4673 on NVD

Stay up to date with KrakenD releases and important updates