Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade criu-libsUpgrade netavarkUpgrade fuse-overlayfsUpgrade golang-testsUpgrade libslirp-develUpgrade aardvark-dnsUpgrade buildah-testsUpgrade golang-miscUpgrade golangUpgrade golang-binUpgrade criuUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade toolbox-testsUpgrade oci-seccomp-bpf-hookUpgrade go-toolsetUpgrade podman-remoteUpgrade buildahUpgrade golang-srcUpgrade podman-catatonitUpgrade containers-commonUpgrade osbuild-composer-coreUpgrade osbuild-composerUpgrade delveUpgrade weldr-clientUpgrade container-selinuxUpgrade crunUpgrade osbuild-composer-dnf-jsonUpgrade python3-podmanUpgrade git-lfsUpgrade conmonUpgrade critUpgrade skopeo-testsUpgrade golang-docsUpgrade python3-criuUpgrade podmanUpgrade podman-testsUpgrade udicaUpgrade golang-raceUpgrade podman-pluginsUpgrade skopeoUpgrade slirp4netnsUpgrade runcUpgrade toolboxUpgrade podman-gvproxyUpgrade libslirpUpgrade grafanaUpgrade criu-develUpgrade podman-dockerUpgrade osbuild-composer-worker | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-sharedUpgrade golang-raceUpgrade golang-miscUpgrade golangUpgrade golang-binUpgrade golang-srcUpgrade golang-testsUpgrade golang-docs | Apr 21, 2023 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-raceUpgrade golang-miscUpgrade golang-testsUpgrade golang-binUpgrade golang-srcUpgrade golangUpgrade golang-docsUpgrade golang-shared | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade conmon-debuginfoUpgrade criu-libs-debuginfoUpgrade libslirp-debuginfoUpgrade runc-debugsourceUpgrade libslirp-develUpgrade python3-osbuildUpgrade go-toolsetUpgrade grafanaUpgrade git-lfs-debuginfoUpgrade crun-debuginfoUpgrade osbuild-selinuxUpgrade slirp4netns-debuginfoUpgrade criu-develUpgrade podman-debuginfoUpgrade grafana-debugsourceUpgrade runc-debuginfoUpgrade udicaUpgrade python3-criuUpgrade runcUpgrade skopeo-testsUpgrade weldr-client-debuginfoUpgrade aardvark-dnsUpgrade osbuild-composer-worker-debuginfoUpgrade podman-plugins-debuginfoUpgrade golang-docsUpgrade git-lfsUpgrade weldr-clientUpgrade buildah-testsUpgrade delveUpgrade golang-binUpgrade containers-commonUpgrade cockpit-podmanUpgrade osbuild-composerUpgrade podman-debugsourceUpgrade podman-dockerUpgrade podman-remoteUpgrade osbuildUpgrade toolbox-debuginfoUpgrade toolbox-debugsourceUpgrade criu-debugsourceUpgrade container-selinuxUpgrade critUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-pluginsUpgrade skopeo-debuginfoUpgrade slirp4netns-debugsourceUpgrade crun-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade osbuild-composer-workerUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-luks2Upgrade podman-gvproxyUpgrade skopeo-debugsourceUpgrade skopeoUpgrade osbuild-composer-coreUpgrade libslirpUpgrade golangUpgrade criuUpgrade delve-debuginfoUpgrade weldr-client-tests-debuginfoUpgrade podman-pluginsUpgrade podman-catatonitUpgrade toolboxUpgrade slirp4netnsUpgrade crunUpgrade weldr-client-debugsourceUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-debuginfoUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade cockpit-composerUpgrade podman-testsUpgrade grafana-debuginfoUpgrade osbuild-ostreeUpgrade osbuild-composer-core-debuginfoUpgrade netavarkUpgrade golang-srcUpgrade conmon-debugsourceUpgrade buildah-tests-debuginfoUpgrade buildahUpgrade fuse-overlayfsUpgrade golang-testsUpgrade git-lfs-debugsourceUpgrade criu-libsUpgrade buildah-debugsourceUpgrade toolbox-testsUpgrade fuse-overlayfs-debugsourceUpgrade golang-raceUpgrade fuse-overlayfs-debuginfoUpgrade osbuild-lvm2Upgrade golang-miscUpgrade python3-podmanUpgrade podmanUpgrade delve-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade buildah-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmon | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go118Upgrade go119 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Mar 9, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jan 9, 2023 | Oct 14, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade weldr-clientUpgrade critUpgrade udicaUpgrade container-selinuxUpgrade podman-dockerUpgrade conmonUpgrade go-toolsetUpgrade golang-docsUpgrade podman-catatonitUpgrade podman-pluginsUpgrade cockpit-composerUpgrade podman-testsUpgrade skopeo-testsUpgrade buildah-testsUpgrade osbuild-composer-workerUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade python3-podmanUpgrade osbuild-luks2Upgrade runcUpgrade criu-develUpgrade libslirpUpgrade crunUpgrade podman-gvproxyUpgrade python3-criuUpgrade criuUpgrade golang-testsUpgrade golang-raceUpgrade delveUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade criu-libsUpgrade podmanUpgrade osbuild-selinuxUpgrade osbuild-lvm2Upgrade podman-remoteUpgrade golang-binUpgrade skopeoUpgrade buildahUpgrade aardvark-dnsUpgrade git-lfsUpgrade golang-miscUpgrade osbuild-composer-coreUpgrade oci-seccomp-bpf-hookUpgrade osbuild-ostreeUpgrade python3-osbuildUpgrade fuse-overlayfsUpgrade golangUpgrade grafanaUpgrade containers-commonUpgrade golang-srcUpgrade osbuild-composerUpgrade netavarkUpgrade osbuild-composer-dnf-jsonUpgrade osbuild | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade conmonUpgrade ignitionUpgrade skopeoUpgrade openshift-clientsUpgrade podmanUpgrade buildah | Jan 18, 2023 | Oct 4, 2022 |
| Redhat_linux | — | Upgrade podman-catatonit-debuginfoUpgrade runc-debuginfoUpgrade osbuild-composerUpgrade podman-catatonitUpgrade skopeoUpgrade delveUpgrade podman-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade cockpit-composerUpgrade golang-docsUpgrade python3-criuUpgrade osbuild-composer-tests-debuginfoUpgrade delve-debuginfoUpgrade podmanUpgrade toolboxUpgrade slirp4netns-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade containers-commonUpgrade podman-debugsourceUpgrade osbuild-selinuxUpgrade slirp4netns-debuginfoUpgrade golang-miscUpgrade delve-debugsourceUpgrade skopeo-testsUpgrade toolbox-debugsourceUpgrade criu-libsUpgrade podman-gvproxy-debuginfoUpgrade git-lfs-debuginfoUpgrade libslirp-develUpgrade golang-testsUpgrade osbuild-composer-coreUpgrade criuUpgrade libslirp-debuginfoUpgrade osbuild-composer-workerUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade golangUpgrade osbuild-lvm2Upgrade podman-pluginsUpgrade podman-remote-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade golang-srcUpgrade criu-libs-debuginfoUpgrade weldr-client-debuginfoUpgrade crun-debugsourceUpgrade criu-debugsourceUpgrade toolbox-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade buildah-debugsourceUpgrade golang-binUpgrade fuse-overlayfs-debugsourceUpgrade python3-osbuildUpgrade criu-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade netavarkUpgrade osbuild-ostreeUpgrade podman-remoteUpgrade critUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade osbuildUpgrade aardvark-dnsUpgrade runc-debugsourceUpgrade runcUpgrade buildah-tests-debuginfoUpgrade osbuild-composer-debuginfoUpgrade golang-raceUpgrade toolbox-testsUpgrade skopeo-debugsourceUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-testsUpgrade podman-plugins-debuginfoUpgrade git-lfsUpgrade python3-podmanUpgrade libslirp-debugsourceUpgrade osbuild-luks2Upgrade udicaUpgrade skopeo-debuginfoUpgrade go-toolsetUpgrade container-selinuxUpgrade conmon-debuginfoUpgrade buildah-testsUpgrade grafanaUpgrade conmonUpgrade buildahUpgrade osbuild-composer-debugsourceUpgrade fuse-overlayfsUpgrade libslirpUpgrade git-lfs-debugsourceUpgrade grafana-debugsourceUpgrade conmon-debugsourceUpgrade grafana-debuginfoUpgrade weldr-clientUpgrade podman-dockerUpgrade buildah-debuginfoNo solution existsUpgrade weldr-client-tests-debuginfoUpgrade weldr-client-debugsourceUpgrade crun-debuginfoUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade cockpit-podman | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade libslirp-develUpgrade skopeoUpgrade skopeo-debugsourceUpgrade containers-commonUpgrade criu-libsUpgrade golangUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debugsourceUpgrade criuUpgrade podmanUpgrade toolboxUpgrade crunUpgrade delve-debuginfoUpgrade libslirpUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade podman-testsUpgrade skopeo-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade buildah-tests-debuginfoUpgrade podman-catatonit-debuginfoUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade buildahUpgrade slirp4netnsUpgrade delve-debugsourceUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade golang-raceUpgrade criu-debuginfoUpgrade netavarkUpgrade crun-debuginfoUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade criu-develUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-testsUpgrade golang-binUpgrade podman-remoteUpgrade aardvark-dnsUpgrade slirp4netns-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade delveUpgrade podman-debuginfoUpgrade runc-debuginfoUpgrade libslirp-debugsourceUpgrade go-toolsetUpgrade conmon-debuginfoUpgrade skopeo-testsUpgrade libslirp-debuginfoUpgrade critUpgrade containernetworking-pluginsUpgrade toolbox-testsUpgrade podman-debugsourceUpgrade slirp4netns-debuginfoUpgrade toolbox-debuginfoUpgrade criu-debugsourceUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade criu-libs-debuginfoUpgrade runcUpgrade crun-debugsource | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.18Upgrade go1.18-opensslUpgrade go1.19Upgrade go1.18-docUpgrade go1.19-docUpgrade go1.18-raceUpgrade go1.18-openssl-raceUpgrade go1.18-openssl-docUpgrade go1.19-race | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.13-goUpgrade golang-1.13-srcUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.16-srcUpgrade golang-1.16-goUpgrade golang-1.16Upgrade golang-1.18-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro) | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub