CVE-2026-39825

Vulnerability

Overview

CVE-2026-39825 is a medium-severity vulnerability in Go's net/http/httputil.ReverseProxy. When the proxy is used with a Rewrite function or a Director function that parses query parameters, it sanitizes the forwarded request by removing parameters not parsed by url.ParseQuery. However, the proxy does not account for ParseQuery's limit on the total number of query parameters, which is controlled by the GODEBUG=urlmaxqueryparams=N setting [1][2].

Exploitation

Mechanism

An attacker can craft a query string containing more parameters than the ParseQuery limit (default 10000). For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can include a parameter (hidden=y) that exceeds the limit. The ParseQuery function ignores parameters beyond the limit, but ReverseProxy does not strip them from the forwarded request. This allows the hidden parameter to be forwarded to the backend server while remaining invisible to the proxy's Rewrite function [3].

Impact

A remote attacker who can send requests to the proxy can inject arbitrary query parameters that bypass the Rewrite function's processing. This could lead to unintended behavior on the backend, such as parameter pollution, access to hidden endpoints, or manipulation of application logic that relies on the proxy's rewriting. The vulnerability does not require authentication if the proxy is publicly accessible [2].

Mitigation

The vulnerability is fixed in Go versions 1.25.10 and 1.26.3 [1]. Users should upgrade to these versions or later. The fix ensures that ReverseProxy avoids forwarding parameters that exceed the ParseQuery limit. No workaround is available other than upgrading [3].