Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-gvproxyUpgrade grafanaUpgrade runcUpgrade skopeoUpgrade python3-criuUpgrade podmanUpgrade podman-pluginsUpgrade container-selinuxUpgrade python3-podmanUpgrade libslirpUpgrade weldr-clientUpgrade toolboxUpgrade udicaUpgrade conmonUpgrade git-lfsUpgrade delveUpgrade critUpgrade osbuild-composer-dnf-jsonUpgrade golang-docsUpgrade podman-dockerUpgrade crunUpgrade skopeo-testsUpgrade podman-testsUpgrade golang-raceUpgrade slirp4netnsUpgrade criu-develUpgrade osbuild-composer-workerUpgrade golangUpgrade golang-binUpgrade golang-miscUpgrade osbuild-composerUpgrade libslirp-develUpgrade buildah-testsUpgrade containers-commonUpgrade osbuild-composer-coreUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade go-toolsetUpgrade netavarkUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade criu-libsUpgrade criuUpgrade oci-seccomp-bpf-hookUpgrade toolbox-testsUpgrade golang-testsUpgrade podman-catatonitUpgrade buildahUpgrade golang-srcUpgrade podman-remote | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-sharedUpgrade golang-raceUpgrade golang-miscUpgrade golangUpgrade golang-srcUpgrade golang-binUpgrade golang-testsUpgrade golang-docs | Apr 21, 2023 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-binUpgrade golang-raceUpgrade golang-miscUpgrade golang-testsUpgrade golang-srcUpgrade golang-sharedUpgrade golangUpgrade golang-docs | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade aardvark-dnsUpgrade podman-remoteUpgrade criu-develUpgrade libslirp-develUpgrade slirp4netns-debuginfoUpgrade crun-debuginfoUpgrade python3-osbuildUpgrade criu-libs-debuginfoUpgrade go-toolsetUpgrade grafanaUpgrade runc-debuginfoUpgrade libslirp-debuginfoUpgrade podman-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-testsUpgrade runcUpgrade git-lfsUpgrade containers-commonUpgrade grafana-debugsourceUpgrade crun-debugsourceUpgrade osbuild-luks2Upgrade weldr-client-debuginfoUpgrade podman-gvproxyUpgrade osbuild-composer-tests-debuginfoUpgrade cockpit-podmanUpgrade podman-dockerUpgrade python3-criuUpgrade osbuild-composer-workerUpgrade slirp4netns-debugsourceUpgrade osbuild-composer-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade osbuildUpgrade golang-binUpgrade osbuild-composerUpgrade weldr-clientUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade buildah-testsUpgrade podman-plugins-debuginfoUpgrade delveUpgrade golang-docsUpgrade osbuild-selinuxUpgrade runc-debugsourceUpgrade conmon-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade libslirp-debugsourceUpgrade podman-debuginfoUpgrade criu-debugsourceUpgrade udicaUpgrade toolbox-debuginfoUpgrade toolbox-debugsourceUpgrade git-lfs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-debuginfoUpgrade critUpgrade buildah-debuginfoUpgrade libslirpUpgrade fuse-overlayfs-debuginfoUpgrade conmonUpgrade podman-catatonit-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade grafana-debuginfoUpgrade podman-remote-debuginfoUpgrade delve-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-debuginfoUpgrade golangUpgrade slirp4netnsUpgrade osbuild-composer-coreUpgrade skopeo-debugsourceUpgrade skopeoUpgrade podman-testsUpgrade git-lfs-debugsourceUpgrade fuse-overlayfsUpgrade crunUpgrade criu-libsUpgrade buildah-debugsourceUpgrade toolbox-testsUpgrade golang-testsUpgrade podman-pluginsUpgrade toolboxUpgrade podman-catatonitUpgrade delve-debuginfoUpgrade weldr-client-tests-debuginfoUpgrade osbuild-ostreeUpgrade osbuild-composer-core-debuginfoUpgrade netavarkUpgrade golang-srcUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debugsourceUpgrade buildahUpgrade cockpit-composerUpgrade criuUpgrade weldr-client-debugsourceUpgrade golang-miscUpgrade python3-podmanUpgrade podmanUpgrade osbuild-lvm2Upgrade golang-raceUpgrade criu-debuginfo | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Mar 9, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jan 9, 2023 | Oct 14, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade golang-binUpgrade aardvark-dnsUpgrade skopeoUpgrade buildahUpgrade osbuild-selinuxUpgrade osbuild-composer-coreUpgrade containers-commonUpgrade git-lfsUpgrade containernetworking-pluginsUpgrade netavarkUpgrade osbuild-ostreeUpgrade osbuild-composerUpgrade python3-osbuildUpgrade golang-srcUpgrade libslirp-develUpgrade podman-remoteUpgrade podmanUpgrade golang-miscUpgrade osbuild-lvm2Upgrade oci-seccomp-bpf-hookUpgrade osbuildUpgrade criu-libsUpgrade grafanaUpgrade golangUpgrade fuse-overlayfsUpgrade osbuild-composer-dnf-jsonUpgrade cockpit-composerUpgrade golang-raceUpgrade podman-catatonitUpgrade podman-testsUpgrade go-toolsetUpgrade conmonUpgrade weldr-clientUpgrade podman-pluginsUpgrade slirp4netnsUpgrade osbuild-composer-workerUpgrade cockpit-podmanUpgrade golang-docsUpgrade delveUpgrade criuUpgrade criu-develUpgrade runcUpgrade osbuild-luks2Upgrade libslirpUpgrade python3-podmanUpgrade udicaUpgrade critUpgrade buildah-testsUpgrade golang-testsUpgrade crunUpgrade python3-criuUpgrade podman-gvproxyUpgrade skopeo-testsUpgrade podman-dockerUpgrade container-selinux | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade ignitionUpgrade skopeoUpgrade buildahUpgrade openshift-clientsUpgrade podmanUpgrade conmon | Jan 18, 2023 | Oct 4, 2022 |
| Redhat_linux | — | Upgrade python3-criuUpgrade golangUpgrade python3-osbuildUpgrade weldr-client-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade criu-debugsourceUpgrade critUpgrade osbuild-lvm2Upgrade containers-commonUpgrade podman-catatonit-debuginfoUpgrade aardvark-dnsUpgrade skopeoUpgrade criu-develUpgrade podman-debuginfoUpgrade runcUpgrade podmanUpgrade osbuild-composerUpgrade osbuild-composer-tests-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-catatonitUpgrade golang-binUpgrade osbuild-composer-worker-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade golang-srcUpgrade delveUpgrade osbuild-composer-dnf-jsonUpgrade criuUpgrade containernetworking-pluginsUpgrade buildah-debugsourceUpgrade osbuildUpgrade golang-testsUpgrade osbuild-composer-workerUpgrade libslirp-develUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade git-lfs-debuginfoUpgrade runc-debugsourceUpgrade libslirp-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade osbuild-composer-coreUpgrade podman-debugsourceUpgrade crun-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-remoteUpgrade netavarkUpgrade delve-debugsourceUpgrade osbuild-ostreeUpgrade podman-remote-debuginfoUpgrade golang-docsUpgrade skopeo-testsUpgrade toolboxUpgrade cockpit-composerUpgrade toolbox-debugsourceUpgrade golang-miscUpgrade osbuild-composer-core-debuginfoUpgrade criu-libs-debuginfoUpgrade osbuild-selinuxUpgrade criu-debuginfoUpgrade delve-debuginfoUpgrade toolbox-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade golang-raceUpgrade toolbox-testsUpgrade conmonUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade osbuild-composer-debugsourceUpgrade git-lfs-debugsourceUpgrade skopeo-debuginfoUpgrade osbuild-composer-debuginfoUpgrade libslirp-debugsourceUpgrade go-toolsetUpgrade grafana-debuginfoUpgrade udicaUpgrade weldr-client-tests-debuginfoUpgrade grafana-debugsourceUpgrade conmon-debugsourceUpgrade libslirpNo solution existsUpgrade crun-debuginfoUpgrade conmon-debuginfoUpgrade podman-dockerUpgrade weldr-clientUpgrade crunUpgrade weldr-client-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade cockpit-podmanUpgrade osbuild-luks2Upgrade podman-gvproxyUpgrade podman-testsUpgrade podman-plugins-debuginfoUpgrade git-lfsUpgrade buildah-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildahUpgrade container-selinuxUpgrade grafanaUpgrade buildah-tests | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade critUpgrade slirp4netns-debuginfoUpgrade libslirp-debuginfoUpgrade runc-debuginfoUpgrade skopeo-testsUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade delveUpgrade runc-debugsourceUpgrade go-toolsetUpgrade criu-libs-debuginfoUpgrade podman-debugsourceUpgrade golang-binUpgrade podman-debuginfoUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-remoteUpgrade runcUpgrade criu-develUpgrade toolbox-debuginfoUpgrade conmon-debuginfoUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade toolbox-debugsourceUpgrade buildah-testsUpgrade crun-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade aardvark-dnsUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-testsUpgrade podman-remote-debuginfoUpgrade golangUpgrade podman-pluginsUpgrade conmonUpgrade buildah-debuginfoUpgrade podman-catatonit-debuginfoUpgrade podman-catatonitUpgrade libslirpUpgrade fuse-overlayfs-debuginfoUpgrade delve-debugsourceUpgrade crun-debuginfoUpgrade buildahUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade delve-debuginfoUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade netavarkUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade skopeo-debuginfoUpgrade conmon-debugsourceUpgrade podman-testsUpgrade containernetworking-plugins-debugsourceUpgrade buildah-tests-debuginfoUpgrade skopeoUpgrade libslirp-develUpgrade golang-raceUpgrade fuse-overlayfs-debugsourceUpgrade crunUpgrade toolboxUpgrade criuUpgrade podmanUpgrade criu-debuginfoUpgrade criu-libsUpgrade containers-commonUpgrade skopeo-debugsource | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.18-openssl-raceUpgrade go1.18-raceUpgrade go1.18-openssl-docUpgrade go1.19-raceUpgrade go1.18-docUpgrade go1.18-opensslUpgrade go1.18Upgrade go1.19-docUpgrade go1.19 | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.13Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.18-srcUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.18Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.16-goUpgrade golang-1.16 | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub