Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirp-develUpgrade golang-srcUpgrade golangUpgrade go-toolsetUpgrade podman-catatonitUpgrade buildahUpgrade podman-remoteUpgrade cockpit-podmanUpgrade golang-testsUpgrade osbuild-composerUpgrade aardvark-dnsUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade criu-libsUpgrade netavarkUpgrade osbuild-composer-coreUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade fuse-overlayfsUpgrade golang-binUpgrade toolbox-testsUpgrade golang-miscUpgrade python3-podmanUpgrade udicaUpgrade skopeo-testsUpgrade container-selinuxUpgrade podman-testsUpgrade weldr-clientUpgrade golang-docsUpgrade toolboxUpgrade python3-criuUpgrade git-lfsUpgrade runcUpgrade podman-pluginsUpgrade grafanaUpgrade delveUpgrade podmanUpgrade golang-raceUpgrade podman-dockerUpgrade osbuild-composer-dnf-jsonUpgrade crunUpgrade podman-gvproxyUpgrade conmonUpgrade libslirpUpgrade slirp4netnsUpgrade critUpgrade criu-develUpgrade osbuild-composer-workerUpgrade skopeo | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-raceUpgrade golang-sharedUpgrade golang-miscUpgrade golang-srcUpgrade golang-testsUpgrade golang-docsUpgrade golang-binUpgrade golang | Apr 21, 2023 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-binUpgrade golang-raceUpgrade golang-testsUpgrade golang-miscUpgrade golang-sharedUpgrade golang-docsUpgrade golangUpgrade golang-src | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade criu-debugsourceUpgrade critUpgrade toolbox-debuginfoUpgrade container-selinuxUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade go-toolsetUpgrade podman-debuginfoUpgrade libslirp-debugsourceUpgrade osbuild-selinuxUpgrade toolbox-debugsourceUpgrade git-lfs-debuginfoUpgrade skopeo-debuginfoUpgrade runc-debuginfoUpgrade weldr-client-debuginfoUpgrade containers-commonUpgrade udicaUpgrade python3-criuUpgrade skopeo-testsUpgrade git-lfsUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade cockpit-podmanUpgrade podman-dockerUpgrade runc-debugsourceUpgrade podman-remoteUpgrade runcUpgrade podman-debugsourceUpgrade libslirp-develUpgrade slirp4netns-debuginfoUpgrade libslirp-debuginfoUpgrade crun-debuginfoUpgrade python3-osbuildUpgrade grafanaUpgrade aardvark-dnsUpgrade osbuildUpgrade golang-binUpgrade osbuild-composerUpgrade delveUpgrade buildah-testsUpgrade golang-docsUpgrade podman-plugins-debuginfoUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade conmon-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-pluginsUpgrade podman-gvproxyUpgrade criu-develUpgrade osbuild-composer-workerUpgrade osbuild-luks2Upgrade grafana-debugsourceUpgrade slirp4netns-debugsourceUpgrade crun-debugsourceUpgrade weldr-clientUpgrade golang-srcUpgrade conmon-debugsourceUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade delve-debugsourceUpgrade osbuild-composer-dnf-jsonUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade libslirpUpgrade criu-libsUpgrade buildah-debugsourceUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-debuginfoUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade cockpit-composerUpgrade weldr-client-debugsourceUpgrade golangUpgrade golang-raceUpgrade criuUpgrade toolbox-testsUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade skopeoUpgrade podman-testsUpgrade golang-testsUpgrade git-lfs-debugsourceUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade osbuild-composer-coreUpgrade crunUpgrade grafana-debuginfoUpgrade conmonUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade python3-podmanUpgrade podmanUpgrade osbuild-lvm2Upgrade golang-miscUpgrade delve-debuginfoUpgrade weldr-client-tests-debuginfoUpgrade toolboxUpgrade podman-pluginsUpgrade podman-catatonitUpgrade osbuild-ostreeUpgrade osbuild-composer-core-debuginfoUpgrade netavark | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Mar 9, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jan 9, 2023 | Oct 14, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade weldr-clientUpgrade golang-raceUpgrade container-selinuxUpgrade skopeo-testsUpgrade podman-dockerUpgrade slirp4netnsUpgrade python3-podmanUpgrade buildah-testsUpgrade critUpgrade udicaUpgrade runcUpgrade criu-develUpgrade osbuild-luks2Upgrade libslirpUpgrade podman-gvproxyUpgrade golang-testsUpgrade python3-criuUpgrade delveUpgrade golang-docsUpgrade podman-pluginsUpgrade cockpit-composerUpgrade conmonUpgrade cockpit-podmanUpgrade osbuild-composer-workerUpgrade criuUpgrade podman-testsUpgrade go-toolsetUpgrade crunUpgrade podman-catatonitUpgrade golang-srcUpgrade git-lfsUpgrade osbuild-selinuxUpgrade osbuild-ostreeUpgrade osbuild-composerUpgrade netavarkUpgrade libslirp-develUpgrade osbuildUpgrade podmanUpgrade podman-remoteUpgrade grafanaUpgrade containers-commonUpgrade criu-libsUpgrade fuse-overlayfsUpgrade python3-osbuildUpgrade golangUpgrade osbuild-composer-dnf-jsonUpgrade buildahUpgrade golang-binUpgrade osbuild-lvm2Upgrade skopeoUpgrade golang-miscUpgrade osbuild-composer-coreUpgrade oci-seccomp-bpf-hookUpgrade aardvark-dnsUpgrade containernetworking-plugins | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade conmonUpgrade ignitionUpgrade openshift-clientsUpgrade buildahUpgrade skopeoUpgrade podman | Jan 18, 2023 | Oct 4, 2022 |
| Redhat_linux | — | Upgrade skopeo-debugsourceUpgrade osbuild-luks2Upgrade weldr-client-tests-debuginfoUpgrade udicaNo solution existsUpgrade weldr-clientUpgrade osbuild-composer-debuginfoUpgrade go-toolsetUpgrade weldr-client-debugsourceUpgrade crunUpgrade golang-raceUpgrade crun-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade toolbox-testsUpgrade podman-dockerUpgrade libslirp-debugsourceUpgrade osbuild-composer-debugsourceUpgrade libslirpUpgrade git-lfs-debugsourceUpgrade fuse-overlayfsUpgrade conmon-debuginfoUpgrade cockpit-podmanUpgrade buildah-debuginfoUpgrade podman-gvproxyUpgrade grafanaUpgrade grafana-debugsourceUpgrade skopeo-debuginfoUpgrade buildah-testsUpgrade container-selinuxUpgrade podman-plugins-debuginfoUpgrade git-lfsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildahUpgrade conmonUpgrade python3-podmanUpgrade conmon-debugsourceUpgrade podman-testsUpgrade slirp4netnsUpgrade grafana-debuginfoUpgrade libslirp-develUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade osbuild-selinuxUpgrade delveUpgrade python3-criuUpgrade toolbox-debuginfoUpgrade podman-remoteUpgrade osbuild-composer-coreUpgrade golang-testsUpgrade criuUpgrade aardvark-dnsUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-lvm2Upgrade podman-catatonit-debuginfoUpgrade osbuild-composerUpgrade podmanUpgrade buildah-tests-debuginfoUpgrade critUpgrade weldr-client-debuginfoUpgrade golang-binUpgrade podman-pluginsUpgrade podman-debuginfoUpgrade crun-debugsourceUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade runcUpgrade slirp4netns-debugsourceUpgrade golangUpgrade osbuild-composer-workerUpgrade toolbox-debugsourceUpgrade criu-develUpgrade golang-docsUpgrade toolboxUpgrade skopeo-testsUpgrade golang-miscUpgrade podman-gvproxy-debuginfoUpgrade delve-debuginfoUpgrade cockpit-composerUpgrade osbuild-composer-core-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-debugsourceUpgrade skopeoUpgrade delve-debugsourceUpgrade criu-libsUpgrade buildah-debugsourceUpgrade containers-commonUpgrade slirp4netns-debuginfoUpgrade netavarkUpgrade osbuild-ostreeUpgrade runc-debugsourceUpgrade osbuild-composer-worker-debuginfoUpgrade osbuildUpgrade osbuild-composer-dnf-jsonUpgrade golang-srcUpgrade podman-remote-debuginfoUpgrade criu-debuginfoUpgrade python3-osbuildUpgrade libslirp-debuginfoUpgrade criu-libs-debuginfoUpgrade git-lfs-debuginfoUpgrade runc-debuginfo | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade libslirp-develUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade golang-raceUpgrade skopeoUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade crun-debuginfoUpgrade delve-debugsourceUpgrade buildah-debugsourceUpgrade podman-pluginsUpgrade buildahUpgrade criu-debuginfoUpgrade netavarkUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmonUpgrade criuUpgrade podman-testsUpgrade podman-catatonit-debuginfoUpgrade skopeo-debuginfoUpgrade delve-debuginfoUpgrade libslirpUpgrade podman-catatonitUpgrade buildah-tests-debuginfoUpgrade golangUpgrade podmanUpgrade podman-gvproxyUpgrade toolboxUpgrade containers-commonUpgrade slirp4netnsUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade buildah-debuginfoUpgrade criu-libs-debuginfoUpgrade toolbox-debuginfoUpgrade criu-debugsourceUpgrade delveUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade runc-debugsourceUpgrade toolbox-testsUpgrade podman-debugsourceUpgrade critUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade golang-binUpgrade runcUpgrade crun-debugsourceUpgrade criu-develUpgrade podman-remoteUpgrade conmon-debuginfoUpgrade aardvark-dnsUpgrade podman-gvproxy-debuginfoUpgrade slirp4netns-debugsourceUpgrade buildah-testsUpgrade runc-debuginfoUpgrade podman-debuginfoUpgrade libslirp-debugsourceUpgrade go-toolsetUpgrade podman-plugins-debuginfoUpgrade python3-criu | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.1.14 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.18-openssl-raceUpgrade go1.18-openssl-docUpgrade go1.19-raceUpgrade go1.18-raceUpgrade go1.18-opensslUpgrade go1.18-docUpgrade go1.19Upgrade go1.19-docUpgrade go1.18 | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.16-goUpgrade golang-1.18-srcUpgrade golang-1.18-goUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.16-srcUpgrade golang-1.16Upgrade golang-1.13-srcUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.13 (Ubuntu Pro) | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub