ReverseProxy can forward queries containing parameters not visible to Rewrite functions.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 7, 2026 · NIST NVD

   Detected

   ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=u

2. Jun 17, 2026 · NIST NVD

   Updated

   ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=u

Affected

• cpe golang/goversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-39825

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-39825

  ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.Pa

  nvd.nist.gov

References

• Patch · go.dev
• Issue Tracking · go.dev
• Release Notes · groups.google.com
• Vendor Advisory · pkg.go.dev