Skip to main content

Go ReverseProxy CVE-2026-39825

| EUVDEUVD-2026-28425 MEDIUM
2026-05-07 Go GHSA-h74g-238j-357m
Information Disclosure Net Http Httputil Go Standard Library
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
6.5 MEDIUM

Network-accessible, no auth or interaction needed; adding I:L over official score because hidden parameters forwarded past security filters can affect backend integrity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 23:00 vuln.today
CVSS changed
May 08, 2026 - 22:22 NVD
5.3 (MEDIUM)
Patch available
May 07, 2026 - 21:02 EUVD
CVE Published
May 07, 2026 - 19:41 nvd
MEDIUM 5.3
CVE Published
May 07, 2026 - 19:41 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.

AnalysisAI

Go's net/http/httputil.ReverseProxy fails to account for url.ParseQuery's configurable query-parameter count limit (GODEBUG=urlmaxqueryparams=N) when sanitizing forwarded requests. An unauthenticated remote attacker can craft an HTTP request with a number of query parameters exceeding that limit, causing the proxy's Rewrite or Director function to never inspect parameters appended beyond the threshold - allowing hidden parameters to be silently forwarded to the backend. This is a security control bypass with confidentiality and potential integrity implications wherever the Rewrite function is relied upon as a gatekeeper for query-parameter validation. No public exploit has been identified at time of analysis; the Go team has released patches in versions 1.25.10 and 1.26.3.

Technical ContextAI

The affected component is the net/http/httputil package in the Go standard library, identified by CPE cpe:2.3:a:go_standard_library:net/http/httputil:*:*:*:*:*:*:*:*. Go's url.ParseQuery function, used internally by ReverseProxy to determine which query parameters to sanitize, enforces a configurable ceiling on total parsed parameters via the GODEBUG=urlmaxqueryparams=N runtime setting. Parameters beyond this ceiling are silently dropped by ParseQuery. ReverseProxy's sanitization logic relies on the ParseQuery result to decide what to strip from the forwarded request, but does not apply the same ceiling constraint when constructing the outbound query string. The result is that parameters present in the raw request URL but beyond the parse limit are invisible to any Rewrite or Director function yet are still forwarded verbatim to the upstream backend. No CWE has been formally assigned, though the root cause aligns conceptually with CWE-444 (Inconsistent Interpretation of HTTP Requests, also known as HTTP Request Smuggling at the parameter level) and CWE-706 (Use of Incorrectly-Resolved Name or Reference).

RemediationAI

Upgrade the Go toolchain to version 1.25.10 (for 1.25.x installations) or 1.26.3 (for 1.26.x installations); these versions contain the fix referenced in code-review change https://go.dev/cl/770541. The Go security announcement is available at https://groups.google.com/g/golang-announce/c/qcCIEXso47M and the vulnerability advisory at https://pkg.go.dev/vuln/GO-2026-4976. Red Hat customers should apply RHSA-2026:23262 or RHSA-2026:23264 as appropriate (https://access.redhat.com/errata/RHSA-2026:23262, https://access.redhat.com/errata/RHSA-2026:23264). If an immediate upgrade is not possible, the most effective compensating control is to move query-parameter security validation out of the Rewrite/Director function and into the backend service itself, so that all received parameters - regardless of proxy-side filtering - are validated at the point of processing. Alternatively, explicitly setting GODEBUG=urlmaxqueryparams to a very low threshold (e.g., 100) will limit the parameter overflow window, though this may break legitimate high-cardinality query strings and requires testing for application compatibility. Do not rely solely on the proxy's Rewrite function for security-critical parameter enforcement until patched.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-39825 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy