> CVE-2026-39825

« BACK_TO_HOME
PUBLISHED
2026-05-07 20:16
MODIFIED
2026-05-07 20:38
EPSS (Prob. Exploit)
0.39%
Top 66.6%
DATA SOURCES:
NVD 🔗 2026-05-07 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-02 MSRC 🔗 2026-11-02

> DESCRIPTION

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat OpenShift API for Data Protection
A new version of OpenShift API for Data Protection (OADP) is now available.
Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.5 security update
Red Hat multicluster engine for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this up...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.6 security update
Red Hat multicluster engine for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this up...
Red Hat Security Advisory: golang security update
An update for golang is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Co...
Red Hat Security Advisory: OpenShift Container Platform 4.22.13 bug fix and security update
Red Hat OpenShift Container Platform release 4.22.13 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red...
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.4.2
Red Hat OpenShift Service Mesh 3.4.2 This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for...
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.7
Red Hat OpenShift Service Mesh 3.3.7 This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for...
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.9
Red Hat OpenShift Service Mesh 3.2.9 This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for...
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.12
Red Hat OpenShift Service Mesh 3.1.12 This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for...
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.15
Red Hat OpenShift Service Mesh 3.0.15 This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for...
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Neuron)
Red Hat AI Base Images 3.5.5 (Neuron) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Neuron)
Red Hat AI Base Images 3.4.6 (Neuron) is now available.
Red Hat Security Advisory: OpenShift Container Platform 4.21.41 bug fix and security update
Red Hat OpenShift Container Platform release 4.21.41 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red...
Red Hat Security Advisory: OpenShift Container Platform 4.19.54 bug fix and security update
Red Hat OpenShift Container Platform release 4.19.54 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red...

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

AFFECTED PACKAGES:
Unknown / Unknown
152 versions affected
ALIASES:
BIT-golang-2026-39825, GO-2026-4976

> HISTORIQUE DES MODIFICATIONS

Première apparition
07/05/2026 20:16
Source: NVD
Total des modifications: 0 Dernière mise à jour: 6 months ago

> REFERENCES

https://go.dev/cl/770541
https://go.dev/issue/78948
https://groups.google.com/g/golang-announce/c/qcCIEXso47M
https://pkg.go.dev/vuln/GO-2026-4976
« BACK_TO_HOME