CVE-2026-39825

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.

• https://go.dev/cl/770541Patch
• https://go.dev/issue/78948Issue Tracking
• https://groups.google.com/g/golang-announce/c/qcCIEXso47MRelease Notes
• https://pkg.go.dev/vuln/GO-2026-4976Vendor Advisory

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3982A vulnerability was determined in itsourcecode University Ma…4.3
• CVE-2026-39820Well-crafted inputs reaching ParseAddress, ParseAddressList,…7.5
• CVE-2026-39821The ToASCII and ToUnicode functions incorrectly accept Punyc…9.6
• CVE-2026-39822On Unix systems, opening a file in an os.Root improperly fol…7.8
• CVE-2026-39823CVE-2026-27142 fixed a vulnerability in which URLs were not …6.1
• CVE-2026-39824NewNTUnicodeString does not check for string length overflow…3.3
• CVE-2026-39826If a trusted template author were to write a <script> tag co…6.1
• CVE-2026-39827An authenticated SSH client that repeatedly opened channels …6.5
• CVE-2026-39828When an SSH server authentication callback returned PartialS…6.3
• CVE-2026-39829The RSA and DSA public key parsers did not enforce size limi…7.5
• CVE-2026-3983A security flaw has been discovered in Campcodes Division Re…3.5
• CVE-2026-39830A malicious SSH peer could send unsolicited global request r…9.1