CVE-2026-39825

MEDIUM EPSS 30.9%
Published May 7, 20261mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published May 7, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago

Description

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
30.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 2

VendorProductVersionRange
golanggo* <1.25.10
golanggo*≥1.26.0  –  <1.26.3

References 4

  • go.dev https://go.dev/cl/770541
    Patch
  • go.dev https://go.dev/issue/78948
    Issue Tracking
  • groups.google.com https://groups.google.com/g/golang-announce/c/qcCIEXso47M
    Release Notes
  • pkg.go.dev https://pkg.go.dev/vuln/GO-2026-4976
    Vendor Advisory

Remediation

  • go.dev https://go.dev/cl/770541
    Patch