diff --git a/0075-CVE-2025-4673-net-http-strip-sensitive-proxy-headers.patch b/0075-CVE-2025-4673-net-http-strip-sensitive-proxy-headers.patch
new file mode 100644
index 0000000000000000000000000000000000000000..e553e49f4b14084bdb2a07f9faad6ac6c19625a1
--- /dev/null
+++ b/0075-CVE-2025-4673-net-http-strip-sensitive-proxy-headers.patch
@@ -0,0 +1,67 @@
+From c57072b7250288d37df5d31413c474c02bc21495 Mon Sep 17 00:00:00 2001
+From: Neal Patel <nealpatel@google.com>
+Date: Wed, 21 May 2025 14:11:44 -0400
+Subject: [PATCH] net/http: strip sensitive proxy headers from redirect
+ requests
+
+Similarly to Authentication entries, Proxy-Authentication entries should be stripped to ensure sensitive information is not leaked on redirects outside of the original domain.
+
+https://fetch.spec.whatwg.org/#authentication-entries
+
+Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue.
+
+Updates golang/go#73816
+Fixes golang/go#73905
+Fixes CVE-2025-4673
+
+Confict: no
+Reference:https://go-review.googlesource.com/c/go/+/679255
+
+Change-Id: I1615f31977a2fd014fbc12aae43f82692315a6d0
+Reviewed-on: https://go-review.googlesource.com/c/go/+/679255
+LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+Reviewed-by: Michael Knyszek <mknyszek@google.com>
+Signed-off-by: jichao wu <wujichao1@huawei.com>
+---
+ src/net/http/client.go      | 3 ++-
+ src/net/http/client_test.go | 3 +++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/net/http/client.go b/src/net/http/client.go
+index 1087980..d846847 100644
+--- a/src/net/http/client.go
++++ b/src/net/http/client.go
+@@ -806,7 +806,8 @@ func (c *Client) makeHeadersCopier(ireq *Request) func(req *Request, stripSensit
+ 		for k, vv := range ireqhdr {
+ 			sensitive := false
+ 			switch CanonicalHeaderKey(k) {
+-			case "Authorization", "Www-Authenticate", "Cookie", "Cookie2":
++			case "Authorization", "Www-Authenticate", "Cookie", "Cookie2",
++				"Proxy-Authorization", "Proxy-Authenticate":
+ 				sensitive = true
+ 			}
+ 			if !(sensitive && stripSensitiveHeaders) {
+diff --git a/src/net/http/client_test.go b/src/net/http/client_test.go
+index 1abc528..b64ade7 100644
+--- a/src/net/http/client_test.go
++++ b/src/net/http/client_test.go
+@@ -1548,6 +1548,8 @@ func testClientStripHeadersOnRepeatedRedirect(t *testing.T, mode bool) {
+ 		if r.Host+r.URL.Path != "a.example.com/" {
+ 			if h := r.Header.Get("Authorization"); h != "" {
+ 				t.Errorf("on request to %v%v, Authorization=%q, want no header", r.Host, r.URL.Path, h)
++			} else if h := r.Header.Get("Proxy-Authorization"); h != "" {
++				t.Errorf("on request to %v%v, Proxy-Authorization=%q, want no header", r.Host, r.URL.Path, h)
+ 			}
+ 		}
+ 		// Follow a chain of redirects from a to b and back to a.
+@@ -1579,6 +1581,7 @@ func testClientStripHeadersOnRepeatedRedirect(t *testing.T, mode bool) {
+ 	req, _ := NewRequest("GET", proto+"://a.example.com/", nil)
+ 	req.Header.Add("Cookie", "foo=bar")
+ 	req.Header.Add("Authorization", "secretpassword")
++	req.Header.Add("Proxy-Authorization", "secretpassword")
+ 	res, err := c.Do(req)
+ 	if err != nil {
+ 		t.Fatal(err)
+-- 
+2.33.0
+
diff --git a/golang.spec b/golang.spec
index aa1163b6d048be56bb2b1c52a8f9dc3a1fc36fd8..22ce28e261a4c28b69f4b7e2a49891355dd55f59 100644
--- a/golang.spec
+++ b/golang.spec
@@ -63,7 +63,7 @@
 
 Name:           golang
 Version:        1.17.3
-Release:        39
+Release:        40
 Summary:        The Go Programming Language
 License:        BSD and Public Domain
 URL:            https://golang.org/
@@ -223,7 +223,8 @@ Patch6070:	0070-Backport-go-build-constraint-add-parsing-limits.patch
 Patch6071:	0071-CVE-2024-45341-crypto-x509-properly-check-for-IPv6-h.patch
 Patch6072:	0072-CVE-2024-45336-net-http-persist-header-stripping-acr.patch
 Patch6073:	0073-crypto-tls-fix-Config.Time-in-tests-using-expir.patch
-Patch6074: 	0074-CVE-2025-22870-do-not-mismatch-IPv6-zone-ids-ag.patch
+Patch6074:	0074-CVE-2025-22870-do-not-mismatch-IPv6-zone-ids-ag.patch
+Patch6075:	0075-CVE-2025-4673-net-http-strip-sensitive-proxy-headers.patch
 
 ExclusiveArch:  %{golang_arches}
 
@@ -462,6 +463,12 @@ fi
 %files devel -f go-tests.list -f go-misc.list -f go-src.list
 
 %changelog
+* Mon Jun 23 2025 wujichao <wujichao1@huawei.com> - 1.17.3-40
+- Type:CVE
+- CVE:CVE-2025-4673
+- SUG:NA
+- DESC:fix CVE-2025-4673
+
 * Tue Apr 08 2025 wujichao <wujichao1@huawei.com> - 1.17.3-39
 - Type:CVE
 - CVE:CVE-2025-22870