CVE-2026-39825
mediumpriority · track · 0EPSS 0.004 · 34 %ileDEEURUUSEPSS · scored 2026-10-21
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (43)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux Advanced Cluster Management for Kubernetesall versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_management_for_kubernetes
- Red Hat Enterprise Linux Advanced Cluster Securityall versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security
- Red Hat Enterprise Linux Edge Managerall versionscert_bundDEcpe:/o:redhat:enterprise_linux:edge_manager
- Red Hat Enterprise Linux Multicluster Engine for Kubernetesall versionscert_bundDEcpe:/o:redhat:enterprise_linux:multicluster_engine_for_kubernetes
- Red Hat OpenShift API for Data Protectionall versionscert_bundDEcpe:/a:redhat:openshift:api_for_data_protection
- Red Hat OpenShift Container Platformall versionscert_bundDEcpe:/a:redhat:openshift:container_platform
- Red Hat OpenShift OpenStack Servicesall versionscert_bundDEcpe:/a:redhat:openshift:openstack_services
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1437Golang Go: Mehrere SchwachstellenDeutsch2026-05-07csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2026-2455Oracle Solaris Drittanbieterkomponenten: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2026-3046IBM Concert: Mehrere SchwachstellenDeutsch2026-08-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
- BIT-golang-2026-39825ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil2026-05-11vendor · osvUS
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.
- GO-2026-4976ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil2026-05-07vendor · osvUS
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.
also known as (6)
Other names and identifiers for this entity.
- CNNVD-202605-1456cnnvd
- EUVD-2026-28425enisa_euvd
- BDU:2026-08060fstec_bdu
- GHSA-h74g-238j-357menisa_euvd
- BIT-golang-2026-39825osv
- GO-2026-4976osv
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://go.dev/dl/Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-39825cnnvd
- https://go.dev/cl/770541enisa_euvd
- https://go.dev/issue/78948enisa_euvd
- https://groups.google.com/g/golang-announce/c/qcCIEXso47Menisa_euvd
- https://pkg.go.dev/vuln/GO-2026-4976enisa_euvd
- https://go.dev/cl/770541Patchnvd
- https://go.dev/issue/78948Issue Trackingnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan