Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafanaUpgrade slirp4netnsUpgrade golang-docsUpgrade podman-dockerUpgrade libslirpUpgrade python3-criuUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade podman-pluginsUpgrade osbuild-composer-workerUpgrade podman-testsUpgrade python3-podmanUpgrade git-lfsUpgrade container-selinuxUpgrade golang-raceUpgrade skopeoUpgrade delveUpgrade criu-develUpgrade toolboxUpgrade podmanUpgrade crunUpgrade runcUpgrade udicaUpgrade osbuild-composer-dnf-jsonUpgrade critUpgrade weldr-clientUpgrade conmonUpgrade criu-libsUpgrade golangUpgrade buildahUpgrade podman-catatonitUpgrade libslirp-develUpgrade cockpit-podmanUpgrade buildah-testsUpgrade criuUpgrade golang-srcUpgrade oci-seccomp-bpf-hookUpgrade osbuild-composer-coreUpgrade netavarkUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade osbuild-composerUpgrade golang-miscUpgrade golang-testsUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade go-toolsetUpgrade toolbox-testsUpgrade golang-bin | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-raceUpgrade golang-sharedUpgrade golang-miscUpgrade golangUpgrade golang-srcUpgrade golang-testsUpgrade golang-binUpgrade golang-docs | Apr 21, 2023 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-srcUpgrade golang-docsUpgrade golangUpgrade golang-sharedUpgrade golang-binUpgrade golang-raceUpgrade golang-testsUpgrade golang-misc | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade netavarkUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-ostreeUpgrade criuUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade golang-miscUpgrade grafana-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade golang-srcUpgrade weldr-client-debugsourceUpgrade buildah-tests-debuginfoUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debuginfoUpgrade criu-debuginfoUpgrade conmonUpgrade osbuild-composer-debuginfoUpgrade libslirpUpgrade golangUpgrade podman-catatonit-debuginfoUpgrade podman-remote-debuginfoUpgrade osbuild-lvm2Upgrade python3-podmanUpgrade delve-debugsourceUpgrade podmanUpgrade golang-raceUpgrade cockpit-composerUpgrade podman-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade toolboxUpgrade skopeoUpgrade crunUpgrade git-lfs-debugsourceUpgrade criu-libsUpgrade golang-testsUpgrade slirp4netnsUpgrade toolbox-testsUpgrade buildah-debugsourceUpgrade osbuild-composer-coreUpgrade fuse-overlayfsUpgrade delve-debuginfoUpgrade skopeo-debugsourceUpgrade podman-catatonitUpgrade weldr-client-tests-debuginfoUpgrade podman-testsUpgrade slirp4netns-debuginfoUpgrade critUpgrade grafana-debugsourceUpgrade runc-debuginfoUpgrade delveUpgrade grafanaUpgrade crun-debuginfoUpgrade criu-develUpgrade libslirp-develUpgrade golang-docsUpgrade osbuild-composer-workerUpgrade container-selinuxUpgrade weldr-clientUpgrade osbuild-composerUpgrade golang-binUpgrade skopeo-debuginfoUpgrade libslirp-debugsourceUpgrade criu-debugsourceUpgrade containernetworking-pluginsUpgrade toolbox-debugsourceUpgrade toolbox-debuginfoUpgrade python3-osbuildUpgrade go-toolsetUpgrade git-lfsUpgrade containers-commonUpgrade osbuild-selinuxUpgrade podman-gvproxy-debuginfoUpgrade osbuild-composer-debugsourceUpgrade osbuildUpgrade osbuild-composer-tests-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade aardvark-dnsUpgrade weldr-client-debuginfoUpgrade skopeo-testsUpgrade runcUpgrade python3-criuUpgrade podman-remoteUpgrade podman-dockerUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade cockpit-podmanUpgrade runc-debugsourceUpgrade podman-debuginfoUpgrade git-lfs-debuginfoUpgrade podman-gvproxyUpgrade crun-debugsourceUpgrade slirp4netns-debugsourceUpgrade osbuild-luks2Upgrade udicaUpgrade libslirp-debuginfoUpgrade criu-libs-debuginfoUpgrade podman-plugins-debuginfoUpgrade conmon-debuginfoUpgrade buildah-testsUpgrade osbuild-composer-worker-debuginfo | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Mar 9, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jan 9, 2023 | Oct 14, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade python3-podmanUpgrade criu-develUpgrade udicaUpgrade skopeo-testsUpgrade libslirpUpgrade osbuild-composer-workerUpgrade buildah-testsUpgrade slirp4netnsUpgrade osbuild-luks2Upgrade critUpgrade cockpit-podmanUpgrade cockpit-composerUpgrade criuUpgrade podman-dockerUpgrade golang-testsUpgrade container-selinuxUpgrade podman-catatonitUpgrade podman-gvproxyUpgrade go-toolsetUpgrade crunUpgrade runcUpgrade golang-docsUpgrade conmonUpgrade golang-raceUpgrade delveUpgrade weldr-clientUpgrade python3-criuUpgrade podman-testsUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade osbuild-ostreeUpgrade netavarkUpgrade fuse-overlayfsUpgrade golang-srcUpgrade libslirp-develUpgrade osbuild-composerUpgrade osbuild-composer-dnf-jsonUpgrade python3-osbuildUpgrade golangUpgrade grafanaUpgrade golang-binUpgrade git-lfsUpgrade buildahUpgrade skopeoUpgrade aardvark-dnsUpgrade podman-remoteUpgrade podmanUpgrade osbuild-selinuxUpgrade osbuild-lvm2Upgrade osbuildUpgrade criu-libsUpgrade osbuild-composer-coreUpgrade oci-seccomp-bpf-hookUpgrade golang-miscUpgrade containers-common | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade openshift-clientsUpgrade podmanUpgrade skopeoUpgrade buildahUpgrade ignitionUpgrade conmon | Jan 18, 2023 | Oct 14, 2022 |
| Redhat_linux | — | Upgrade runc-debugsourceUpgrade toolbox-debuginfoUpgrade podman-remote-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade golang-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debugsourceUpgrade osbuildUpgrade oci-seccomp-bpf-hookUpgrade osbuild-composer-worker-debuginfoUpgrade golang-miscUpgrade osbuild-ostreeUpgrade python3-criuUpgrade golang-srcUpgrade delveUpgrade libslirp-develUpgrade toolbox-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade osbuild-composer-coreUpgrade criu-libs-debuginfoUpgrade podmanUpgrade podman-remoteUpgrade criu-debuginfoUpgrade podman-catatonit-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade cockpit-composerUpgrade delve-debuginfoUpgrade osbuild-selinuxUpgrade golang-docsUpgrade runcUpgrade osbuild-composer-core-debuginfoUpgrade skopeo-testsUpgrade aardvark-dnsUpgrade buildah-tests-debuginfoUpgrade osbuild-composerUpgrade critUpgrade osbuild-composer-tests-debuginfoUpgrade criu-debugsourceUpgrade containers-commonUpgrade git-lfs-debuginfoUpgrade toolboxUpgrade libslirp-debuginfoUpgrade osbuild-lvm2Upgrade criuUpgrade runc-debuginfoUpgrade podman-debuginfoUpgrade netavarkUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debugsourceUpgrade skopeoUpgrade golang-binUpgrade containernetworking-pluginsUpgrade weldr-client-debuginfoUpgrade criu-libsUpgrade osbuild-composer-workerUpgrade slirp4netns-debugsourceUpgrade criu-develUpgrade fuse-overlayfs-debuginfoUpgrade python3-osbuildUpgrade podman-catatonitUpgrade podman-pluginsUpgrade delve-debugsourceUpgrade crun-debugsourceUpgrade golangUpgrade git-lfs-debugsourceUpgrade libslirp-debugsourceNo solution existsUpgrade libslirpUpgrade udicaUpgrade buildah-testsUpgrade python3-podmanUpgrade buildahUpgrade osbuild-composer-debuginfoUpgrade git-lfsUpgrade podman-plugins-debuginfoUpgrade osbuild-luks2Upgrade skopeo-debugsourceUpgrade grafana-debuginfoUpgrade buildah-debuginfoUpgrade grafana-debugsourceUpgrade conmon-debugsourceUpgrade toolbox-testsUpgrade golang-raceUpgrade osbuild-composer-debugsourceUpgrade cockpit-podmanUpgrade podman-dockerUpgrade weldr-clientUpgrade conmon-debuginfoUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade crunUpgrade podman-testsUpgrade crun-debuginfoUpgrade weldr-client-debugsourceUpgrade fuse-overlayfsUpgrade weldr-client-tests-debuginfoUpgrade skopeo-debuginfoUpgrade container-selinuxUpgrade go-toolsetUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade grafana | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade podman-debugsourceUpgrade toolbox-testsUpgrade conmon-debuginfoUpgrade delveUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade runc-debugsourceUpgrade podman-debuginfoUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade aardvark-dnsUpgrade libslirp-debugsourceUpgrade buildah-testsUpgrade crun-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade criu-develUpgrade runc-debuginfoUpgrade go-toolsetUpgrade critUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade podman-remote-debuginfoUpgrade toolbox-debugsourceUpgrade slirp4netns-debuginfoUpgrade golang-binUpgrade criu-debugsourceUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-testsUpgrade podman-plugins-debuginfoUpgrade buildah-tests-debuginfoUpgrade criu-libsUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfsUpgrade podman-testsUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade golangUpgrade containers-commonUpgrade criu-debuginfoUpgrade delve-debugsourceUpgrade crun-debuginfoUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-debuginfoUpgrade podmanUpgrade toolboxUpgrade criuUpgrade netavarkUpgrade buildah-debuginfoUpgrade podman-pluginsUpgrade conmonUpgrade libslirpUpgrade delve-debuginfoUpgrade crunUpgrade podman-catatonit-debuginfoUpgrade conmon-debugsourceUpgrade libslirp-develUpgrade golang-raceUpgrade podman-catatonitUpgrade skopeoUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hook | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.18Upgrade go1.18-opensslUpgrade go1.19Upgrade go1.18-docUpgrade go1.19-docUpgrade go1.18-openssl-docUpgrade go1.18-raceUpgrade go1.19-raceUpgrade go1.18-openssl-race | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.13-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.13Upgrade golang-1.18-goUpgrade golang-1.18-srcUpgrade golang-1.18Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.16-goUpgrade golang-1.16 | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub