https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:56:03 +0000 https://vulnerability.circl.lu/vuln/cve-2026-39825 <p><strong>Affected:</strong> Go standard library net/http/httputil</p> <p>ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery&#39;s limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query &#34;a1=x&amp;a2=x&amp;...&amp;a10000=x&amp;hidden=y&#34; can forward the parameter &#34;hidden=y&#34; while hiding it from the proxy&#39;s Rewrite function.</p> <p><strong>Affected:</strong> Go standard library net/http/httputil</p> <p>ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery&#39;s limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query &#34;a1=x&amp;a2=x&amp;...&amp;a10000=x&amp;hidden=y&#34; can forward the parameter &#34;hidden=y&#34; while hiding it from the proxy&#39;s Rewrite function.</p> https://vulnerability.circl.lu/vuln/cve-2026-39825