CVE-2022-2880

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.

• CWE-444

• https://go.dev/cl/432976Patch
• https://go.dev/issue/54663Exploit, Issue Tracking, Third Party Advisory
• https://groups.google.com/g/golang-announce/c/xtuG5faxtaUMailing List, Release Notes
• https://pkg.go.dev/vuln/GO-2022-1038Vendor Advisory
• https://security.gentoo.org/glsa/202311-09
• https://go.dev/cl/432976Patch
• https://go.dev/issue/54663Exploit, Issue Tracking, Third Party Advisory
• https://groups.google.com/g/golang-announce/c/xtuG5faxtaUMailing List, Release Notes
• https://pkg.go.dev/vuln/GO-2022-1038Vendor Advisory
• https://security.gentoo.org/glsa/202311-09

Published

Oct 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28792DLL hijacking vulnerability in Gear IconX PC Manager prior t…7.8
• CVE-2022-28793Given the TEE is compromised and controlled by the attacker,…4.4
• CVE-2022-28794Sensitive information exposure in low-battery dumpstate log …3.3
• CVE-2022-28795A vulnerability within the Avira Password Manager Browser Ex…6.5
• CVE-2022-28796jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Li…7
• CVE-2022-28799The TikTok application before 23.7.3 for Android allows acco…8.8
• CVE-2022-28802Code by Zapier before 2022-08-17 allowed intra-account privi…9.9
• CVE-2022-28803In SilverStripe Framework through 2022-04-07, Stored XSS can…5.4
• CVE-2022-28805singlevar in lparser.c in Lua from (including) 5.4.0 up to (…9.1
• CVE-2022-28806An issue was discovered on certain Fujitsu LIEFBOOK devices …7.8
• CVE-2022-28807An issue was discovered in Open Design Alliance Drawings SDK…7.8
• CVE-2022-28808An issue was discovered in Open Design Alliance Drawings SDK…7.8