go net http

On May 14, 2026, CISA republished Siemens ProductCERT advisory SSA-783943 warning that Siemens SENTRON 7KT PAC1261 Data Manager devices before version 2.1.0 can expose authorization tokens through an HTTP request smuggling flaw in Go’s net/http package. The immediate fix is plain enough: update...

A subtle bug in the Go standard library’s net/http client can restore and transmit sensitive headers after a specific sequence of redirects, potentially leaking Authorization tokens and other credentials to unintended targets—security teams and Go developers must treat this as a material risk...