Net Http Httputil
Monthly
Go's net/http/httputil.ReverseProxy fails to account for url.ParseQuery's configurable query-parameter count limit (GODEBUG=urlmaxqueryparams=N) when sanitizing forwarded requests. An unauthenticated remote attacker can craft an HTTP request with a number of query parameters exceeding that limit, causing the proxy's Rewrite or Director function to never inspect parameters appended beyond the threshold - allowing hidden parameters to be silently forwarded to the backend. This is a security control bypass with confidentiality and potential integrity implications wherever the Rewrite function is relied upon as a gatekeeper for query-parameter validation. No public exploit has been identified at time of analysis; the Go team has released patches in versions 1.25.10 and 1.26.3.
Go's net/http/httputil.ReverseProxy fails to account for url.ParseQuery's configurable query-parameter count limit (GODEBUG=urlmaxqueryparams=N) when sanitizing forwarded requests. An unauthenticated remote attacker can craft an HTTP request with a number of query parameters exceeding that limit, causing the proxy's Rewrite or Director function to never inspect parameters appended beyond the threshold - allowing hidden parameters to be silently forwarded to the backend. This is a security control bypass with confidentiality and potential integrity implications wherever the Rewrite function is relied upon as a gatekeeper for query-parameter validation. No public exploit has been identified at time of analysis; the Go team has released patches in versions 1.25.10 and 1.26.3.