Medium severity · published May 7, 2026
CVE-2026-39825
ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
net/http/httputil · Go standard library
before 1.25.10; 1.26.0-0 before 1.26.3 · source: vendor
GO
GO · Golang
before 1.25.10; 1.26.0 before 1.26.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39825
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-39825
Patch
https://go.dev/cl/770541
Issue Tracking
https://go.dev/issue/78948
Release Notes
https://groups.google.com/g/golang-announce/c/qcCIEXso47M
Vendor Advisory
https://pkg.go.dev/vuln/GO-2026-4976
More from net/http/httputil
7.5
CVE-2026-56866
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
7.5
CVE-2022-2880
Incorrect sanitization of forwarded query parameters in net/http/httputil