Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade toolbox-testsUpgrade golang-miscUpgrade criu-libsUpgrade podman-remoteUpgrade podman-catatonitUpgrade criuUpgrade buildahUpgrade golang-testsUpgrade osbuild-composerUpgrade osbuild-composer-coreUpgrade golangUpgrade containers-commonUpgrade netavarkUpgrade libslirp-develUpgrade golang-srcUpgrade cockpit-podmanUpgrade containernetworking-pluginsUpgrade golang-binUpgrade buildah-testsUpgrade go-toolsetUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade libslirpUpgrade delveUpgrade podman-gvproxyUpgrade weldr-clientUpgrade podmanUpgrade python3-criuUpgrade skopeoUpgrade conmonUpgrade git-lfsUpgrade grafanaUpgrade slirp4netnsUpgrade criu-develUpgrade skopeo-testsUpgrade podman-pluginsUpgrade udicaUpgrade runcUpgrade osbuild-composer-workerUpgrade python3-podmanUpgrade podman-dockerUpgrade golang-docsUpgrade container-selinuxUpgrade toolboxUpgrade golang-raceUpgrade crunUpgrade osbuild-composer-dnf-jsonUpgrade podman-testsUpgrade crit | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-sharedUpgrade golang-miscUpgrade golang-raceUpgrade golangUpgrade golang-binUpgrade golang-srcUpgrade golang-testsUpgrade golang-docs | Apr 21, 2023 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-srcUpgrade golang-sharedUpgrade golangUpgrade golang-docsUpgrade golang-binUpgrade golang-raceUpgrade golang-miscUpgrade golang-tests | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade crun-debugsourceUpgrade conmon-debuginfoUpgrade git-lfs-debuginfoUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsUpgrade skopeo-debuginfoUpgrade podman-gvproxyUpgrade toolbox-debugsourceUpgrade container-selinuxUpgrade toolbox-debuginfoUpgrade udicaUpgrade osbuild-composer-workerUpgrade osbuild-luks2Upgrade libslirp-debugsourceUpgrade golang-docsUpgrade delveUpgrade containernetworking-plugins-debuginfoUpgrade osbuild-selinuxUpgrade osbuild-composer-tests-debuginfoUpgrade podman-debuginfoUpgrade aardvark-dnsUpgrade osbuildUpgrade osbuild-composer-debugsourceUpgrade runc-debugsourceUpgrade python3-criuUpgrade runcUpgrade podman-remoteUpgrade skopeo-testsUpgrade podman-gvproxy-debuginfoUpgrade weldr-client-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade buildah-testsUpgrade podman-dockerUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade weldr-clientUpgrade golang-binUpgrade osbuild-composerUpgrade critUpgrade cockpit-podmanUpgrade slirp4netns-debugsourceUpgrade grafana-debugsourceUpgrade grafanaUpgrade libslirp-debuginfoUpgrade criu-develUpgrade runc-debuginfoUpgrade libslirp-develUpgrade slirp4netns-debuginfoUpgrade crun-debuginfoUpgrade git-lfsUpgrade criu-libs-debuginfoUpgrade containers-commonUpgrade go-toolsetUpgrade python3-osbuildUpgrade weldr-client-tests-debuginfoUpgrade conmonUpgrade delve-debuginfoUpgrade podman-pluginsUpgrade criuUpgrade weldr-client-debugsourceUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade libslirpUpgrade golangUpgrade golang-srcUpgrade podman-catatonitUpgrade toolboxUpgrade conmon-debugsourceUpgrade golang-raceUpgrade osbuild-ostreeUpgrade podman-remote-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade delve-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade osbuild-lvm2Upgrade python3-podmanUpgrade podmanUpgrade golang-miscUpgrade netavarkUpgrade osbuild-composer-core-debuginfoUpgrade toolbox-testsUpgrade slirp4netnsUpgrade skopeoUpgrade osbuild-composer-coreUpgrade git-lfs-debugsourceUpgrade fuse-overlayfsUpgrade crunUpgrade buildah-debugsourceUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade cockpit-composerUpgrade buildahUpgrade grafana-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-testsUpgrade criu-debuginfoUpgrade golang-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libsUpgrade skopeo-debugsource | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go118Upgrade go119 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Mar 9, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Jan 9, 2023 | Oct 14, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade criuUpgrade container-selinuxUpgrade podman-pluginsUpgrade libslirpUpgrade podman-dockerUpgrade weldr-clientUpgrade golang-docsUpgrade python3-podmanUpgrade delveUpgrade osbuild-luks2Upgrade criu-develUpgrade runcUpgrade conmonUpgrade go-toolsetUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade skopeo-testsUpgrade python3-criuUpgrade golang-raceUpgrade golang-testsUpgrade crunUpgrade podman-testsUpgrade buildah-testsUpgrade udicaUpgrade cockpit-podmanUpgrade osbuild-composer-workerUpgrade slirp4netnsUpgrade critUpgrade cockpit-composerUpgrade buildahUpgrade osbuild-composer-coreUpgrade golang-srcUpgrade containernetworking-pluginsUpgrade golang-miscUpgrade oci-seccomp-bpf-hookUpgrade golangUpgrade python3-osbuildUpgrade containers-commonUpgrade osbuild-composer-dnf-jsonUpgrade grafanaUpgrade criu-libsUpgrade golang-binUpgrade git-lfsUpgrade podman-remoteUpgrade skopeoUpgrade aardvark-dnsUpgrade osbuild-selinuxUpgrade osbuild-lvm2Upgrade osbuildUpgrade podmanUpgrade osbuild-ostreeUpgrade fuse-overlayfsUpgrade osbuild-composerUpgrade netavarkUpgrade libslirp-devel | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade conmonUpgrade buildahUpgrade ignitionUpgrade skopeoUpgrade openshift-clientsUpgrade podman | Jan 18, 2023 | Oct 4, 2022 |
| Redhat_linux | — | Upgrade skopeo-debuginfoUpgrade go-toolsetUpgrade cockpit-podmanUpgrade osbuild-composer-debuginfoUpgrade libslirp-debugsourceUpgrade weldr-client-debugsourceUpgrade weldr-client-tests-debuginfoUpgrade crun-debuginfoUpgrade skopeo-debugsourceUpgrade crunUpgrade toolbox-testsUpgrade podman-gvproxyUpgrade osbuild-luks2Upgrade udicaUpgrade golang-raceNo solution existsUpgrade containernetworking-plugins-debugsourceUpgrade podman-plugins-debuginfoUpgrade libslirpUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debugsourceUpgrade grafana-debugsourceUpgrade grafana-debuginfoUpgrade podman-dockerUpgrade conmon-debuginfoUpgrade conmonUpgrade grafanaUpgrade container-selinuxUpgrade weldr-clientUpgrade buildah-testsUpgrade python3-podmanUpgrade osbuild-composer-debugsourceUpgrade fuse-overlayfsUpgrade git-lfsUpgrade podman-testsUpgrade buildahUpgrade buildah-debuginfoUpgrade git-lfs-debugsourceUpgrade criuUpgrade git-lfs-debuginfoUpgrade osbuild-composer-coreUpgrade weldr-client-debuginfoUpgrade criu-libsUpgrade crun-debugsourceUpgrade criu-debugsourceUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade podman-debuginfoUpgrade podman-catatonitUpgrade golang-binUpgrade podman-remoteUpgrade libslirp-debuginfoUpgrade libslirp-develUpgrade osbuild-composer-workerUpgrade oci-seccomp-bpf-hookUpgrade golang-testsUpgrade skopeoUpgrade containers-commonUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade podman-debugsourceUpgrade criu-develUpgrade netavarkUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade delve-debugsourceUpgrade python3-criuUpgrade delveUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-selinuxUpgrade toolboxUpgrade podman-gvproxy-debuginfoUpgrade golang-miscUpgrade delve-debuginfoUpgrade golang-docsUpgrade skopeo-testsUpgrade toolbox-debugsourceUpgrade cockpit-composerUpgrade podman-remote-debuginfoUpgrade osbuild-composerUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-lvm2Upgrade critUpgrade buildah-tests-debuginfoUpgrade aardvark-dnsUpgrade podmanUpgrade runcUpgrade podman-catatonit-debuginfoUpgrade toolbox-debuginfoUpgrade osbuildUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-worker-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade runc-debugsourceUpgrade golang-srcUpgrade criu-libs-debuginfoUpgrade slirp4netns-debugsourceUpgrade osbuild-ostreeUpgrade criu-debuginfoUpgrade python3-osbuildUpgrade golangUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hook-debugsource | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade podman-remoteUpgrade podman-debuginfoUpgrade runc-debuginfoUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runcUpgrade criu-develUpgrade python3-criuUpgrade libslirp-debugsourceUpgrade toolbox-debugsourceUpgrade go-toolsetUpgrade runc-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-plugins-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade critUpgrade libslirp-debuginfoUpgrade skopeo-testsUpgrade podman-gvproxy-debuginfoUpgrade criu-debugsourceUpgrade containernetworking-pluginsUpgrade podman-remote-debuginfoUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade golang-binUpgrade slirp4netns-debuginfoUpgrade toolbox-debuginfoUpgrade buildah-testsUpgrade criu-libs-debuginfoUpgrade podman-debugsourceUpgrade toolbox-testsUpgrade delveUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-tests-debuginfoUpgrade golangUpgrade buildah-debugsourceUpgrade podman-gvproxyUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade containers-commonUpgrade conmonUpgrade skopeo-debugsourceUpgrade netavarkUpgrade slirp4netnsUpgrade skopeo-debuginfoUpgrade podman-testsUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade delve-debugsourceUpgrade buildahUpgrade crun-debuginfoUpgrade criu-libsUpgrade toolboxUpgrade podmanUpgrade criuUpgrade libslirp-develUpgrade conmon-debugsourceUpgrade skopeoUpgrade golang-raceUpgrade fuse-overlayfs-debugsourceUpgrade crunUpgrade delve-debuginfoUpgrade podman-catatonitUpgrade libslirpUpgrade podman-catatonit-debuginfo | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.18-openssl-docUpgrade go1.18-openssl-raceUpgrade go1.19-raceUpgrade go1.18-raceUpgrade go1.18-docUpgrade go1.18Upgrade go1.19Upgrade go1.18-opensslUpgrade go1.19-doc | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.18-goUpgrade golang-1.16-srcUpgrade golang-1.16Upgrade golang-1.18Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.16-goUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.13-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13 | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub