CVE-2026-39825 Details
Description
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.
A vulnerability exists in the Go standard library's net/http/httputil package, specifically in the ReverseProxy component. This issue arises because ReverseProxy can forward query parameters that are not visible to the Rewrite function. When a Rewrite function or a Director function that parses query parameters is used, ReverseProxy sanitizes the request by removing query parameters not parsed by url.ParseQuery. However, it fails to consider ParseQuery's limit on the number of query parameters, controlled by GODEBUG=urlmaxqueryparams=N. As a result, ReverseProxy can inadvertently forward hidden query parameters. For instance, a query with 10,000 visible parameters could still forward a 'hidden' parameter without it being detected by the Rewrite function.
Users can upgrade to Go versions 1.26.3 or 1.25.10, both of which include the necessary fix. Instructions for downloading these versions are available on the Go website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://go.dev/cl/770541 | [email protected] | Patch |
| https://go.dev/issue/78948 | [email protected] | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/qcCIEXso47M | [email protected] | Release Notes |
| https://pkg.go.dev/vuln/GO-2026-4976 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| golang go | < 1.25.10 >= 1.26.0, < 1.26.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |