Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-pluginsUpgrade skopeoUpgrade udicaUpgrade critUpgrade toolboxUpgrade python3-criuUpgrade weldr-clientUpgrade podman-gvproxyUpgrade golang-docsUpgrade libslirpUpgrade golang-raceUpgrade container-selinuxUpgrade git-lfsUpgrade python3-podmanUpgrade podmanUpgrade criu-develUpgrade osbuild-composer-workerUpgrade delveUpgrade conmonUpgrade podman-dockerUpgrade slirp4netnsUpgrade podman-testsUpgrade crunUpgrade osbuild-composer-dnf-jsonUpgrade skopeo-testsUpgrade runcUpgrade grafanaUpgrade golang-testsUpgrade criu-libsUpgrade golang-binUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hookUpgrade buildah-testsUpgrade golang-miscUpgrade podman-catatonitUpgrade podman-remoteUpgrade buildahUpgrade golang-srcUpgrade containernetworking-pluginsUpgrade osbuild-composer-coreUpgrade netavarkUpgrade criuUpgrade libslirp-develUpgrade go-toolsetUpgrade osbuild-composerUpgrade aardvark-dnsUpgrade containers-commonUpgrade golangUpgrade cockpit-podman | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade golang-srcUpgrade golangUpgrade golang-docsUpgrade golang-binUpgrade golang-miscUpgrade golang-raceUpgrade golang-shared | Apr 21, 2023 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-miscUpgrade golang-binUpgrade golang-testsUpgrade golang-raceUpgrade golang-sharedUpgrade golang-docsUpgrade golangUpgrade golang-src | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade buildah-tests-debuginfoUpgrade osbuild-ostreeUpgrade netavarkUpgrade buildahUpgrade grafana-debuginfoUpgrade golang-srcUpgrade git-lfs-debugsourceUpgrade golang-testsUpgrade python3-podmanUpgrade containernetworking-plugins-debugsourceUpgrade osbuild-lvm2Upgrade criu-debuginfoUpgrade podman-testsUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-debuginfoUpgrade skopeo-debugsourceUpgrade buildah-debuginfoUpgrade toolbox-testsUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade buildah-debugsourceUpgrade conmonUpgrade toolboxUpgrade osbuild-composer-coreUpgrade podmanUpgrade crunUpgrade skopeoUpgrade criu-libsUpgrade slirp4netnsUpgrade libslirpUpgrade podman-pluginsUpgrade weldr-client-tests-debuginfoUpgrade delve-debuginfoUpgrade golangUpgrade golang-raceUpgrade golang-miscUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade cockpit-composerUpgrade conmon-debugsourceUpgrade weldr-client-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade delve-debugsourceUpgrade podman-catatonitUpgrade osbuild-composer-dnf-jsonUpgrade podman-remote-debuginfoUpgrade criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade go-toolsetUpgrade podman-debuginfoUpgrade containernetworking-pluginsUpgrade udicaUpgrade git-lfs-debuginfoUpgrade skopeo-debuginfoUpgrade toolbox-debuginfoUpgrade criu-debugsourceUpgrade libslirp-debugsourceUpgrade container-selinuxUpgrade toolbox-debugsourceUpgrade python3-osbuildUpgrade grafana-debugsourceUpgrade git-lfsUpgrade containers-commonUpgrade cockpit-podmanUpgrade runc-debuginfoUpgrade weldr-clientUpgrade osbuild-composerUpgrade golang-binUpgrade weldr-client-debuginfoUpgrade skopeo-testsUpgrade runcUpgrade python3-criuUpgrade podman-remoteUpgrade podman-dockerUpgrade podman-debugsourceUpgrade osbuild-composer-debugsourceUpgrade osbuildUpgrade aardvark-dnsUpgrade osbuild-composer-tests-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade osbuild-luks2Upgrade podman-gvproxy-debuginfoUpgrade podman-gvproxyUpgrade osbuild-composer-workerUpgrade crun-debugsourceUpgrade podman-plugins-debuginfoUpgrade buildah-testsUpgrade delveUpgrade conmon-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade golang-docsUpgrade crun-debuginfoUpgrade criu-develUpgrade slirp4netns-debuginfoUpgrade libslirp-develUpgrade libslirp-debuginfoUpgrade criu-libs-debuginfoUpgrade grafanaUpgrade osbuild-selinuxUpgrade critUpgrade runc-debugsource | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go118Upgrade go119 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Mar 9, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jan 9, 2023 | Oct 14, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade podman-pluginsUpgrade podman-testsUpgrade conmonUpgrade go-toolsetUpgrade container-selinuxUpgrade libslirpUpgrade python3-podmanUpgrade criu-develUpgrade podman-dockerUpgrade criuUpgrade osbuild-luks2Upgrade runcUpgrade delveUpgrade skopeo-testsUpgrade udicaUpgrade weldr-clientUpgrade podman-gvproxyUpgrade python3-criuUpgrade crunUpgrade golang-raceUpgrade golang-testsUpgrade cockpit-podmanUpgrade cockpit-composerUpgrade buildah-testsUpgrade golang-docsUpgrade podman-catatonitUpgrade critUpgrade osbuild-composer-workerUpgrade slirp4netnsUpgrade golang-srcUpgrade golang-binUpgrade git-lfsUpgrade osbuild-composerUpgrade libslirp-develUpgrade buildahUpgrade skopeoUpgrade aardvark-dnsUpgrade podman-remoteUpgrade containers-commonUpgrade osbuild-ostreeUpgrade netavarkUpgrade containernetworking-pluginsUpgrade podmanUpgrade criu-libsUpgrade osbuild-lvm2Upgrade osbuildUpgrade osbuild-selinuxUpgrade grafanaUpgrade fuse-overlayfsUpgrade golangUpgrade python3-osbuildUpgrade osbuild-composer-coreUpgrade oci-seccomp-bpf-hookUpgrade golang-miscUpgrade osbuild-composer-dnf-json | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade buildahUpgrade podmanUpgrade skopeoUpgrade openshift-clientsUpgrade ignitionUpgrade conmon | Jan 18, 2023 | Oct 14, 2022 |
| Redhat_linux | — | Upgrade buildahUpgrade grafanaUpgrade conmonUpgrade libslirpUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade podman-testsUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netnsUpgrade weldr-clientUpgrade skopeo-debuginfoUpgrade osbuild-composer-debuginfoUpgrade go-toolsetUpgrade libslirp-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-gvproxyUpgrade conmon-debuginfoUpgrade python3-podmanUpgrade container-selinuxUpgrade grafana-debugsourceUpgrade buildah-debuginfoUpgrade grafana-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade git-lfs-debugsourceUpgrade weldr-client-debugsourceUpgrade weldr-client-tests-debuginfoUpgrade toolbox-testsUpgrade udicaUpgrade crun-debuginfoUpgrade osbuild-composer-debugsourceUpgrade osbuild-luks2Upgrade skopeo-debugsourceNo solution existsUpgrade git-lfsUpgrade golang-raceUpgrade cockpit-podmanUpgrade crunUpgrade conmon-debugsourceUpgrade slirp4netns-debugsourceUpgrade python3-osbuildUpgrade criu-debuginfoUpgrade podman-remoteUpgrade toolbox-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade delveUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade golangUpgrade skopeoUpgrade slirp4netns-debuginfoUpgrade osbuild-ostreeUpgrade podman-debugsourceUpgrade buildah-debugsourceUpgrade cockpit-composerUpgrade delve-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade golang-docsUpgrade golang-miscUpgrade osbuild-selinuxUpgrade toolbox-debugsourceUpgrade toolboxUpgrade skopeo-testsUpgrade golang-binUpgrade podman-catatonit-debuginfoUpgrade delve-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade buildah-tests-debuginfoUpgrade runc-debuginfoUpgrade weldr-client-debuginfoUpgrade osbuild-composerUpgrade osbuild-composer-dnf-jsonUpgrade fuse-overlayfs-debugsourceUpgrade critUpgrade aardvark-dnsUpgrade netavarkUpgrade golang-srcUpgrade osbuildUpgrade osbuild-composer-worker-debuginfoUpgrade criu-develUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade libslirp-debuginfoUpgrade git-lfs-debuginfoUpgrade osbuild-composer-workerUpgrade golang-testsUpgrade osbuild-composer-coreUpgrade criuUpgrade osbuild-lvm2Upgrade osbuild-composer-tests-debuginfoUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade criu-libsUpgrade crun-debugsourceUpgrade containernetworking-pluginsUpgrade podman-pluginsUpgrade podman-debuginfoUpgrade runc-debugsourceUpgrade criu-debugsourceUpgrade podman-catatonitUpgrade runcUpgrade podman | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade libslirp-develUpgrade conmonUpgrade netavarkUpgrade containers-commonUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade crunUpgrade delve-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade podmanUpgrade buildahUpgrade podman-gvproxyUpgrade toolboxUpgrade criuUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade golang-raceUpgrade podman-pluginsUpgrade golangUpgrade slirp4netnsUpgrade delve-debugsourceUpgrade criu-libsUpgrade podman-testsUpgrade criu-debuginfoUpgrade skopeo-debuginfoUpgrade podman-catatonitUpgrade podman-catatonit-debuginfoUpgrade skopeo-debugsourceUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade buildah-debugsourceUpgrade libslirpUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade podman-debuginfoUpgrade podman-remoteUpgrade runc-debuginfoUpgrade toolbox-debugsourceUpgrade podman-remote-debuginfoUpgrade skopeo-testsUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade libslirp-debuginfoUpgrade critUpgrade go-toolsetUpgrade libslirp-debugsourceUpgrade toolbox-testsUpgrade podman-debugsourceUpgrade conmon-debuginfoUpgrade criu-debugsourceUpgrade toolbox-debuginfoUpgrade podman-plugins-debuginfoUpgrade aardvark-dnsUpgrade slirp4netns-debugsourceUpgrade buildah-testsUpgrade podman-gvproxy-debuginfoUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade crun-debugsourceUpgrade criu-develUpgrade golang-binUpgrade containernetworking-plugins-debuginfoUpgrade delveUpgrade criu-libs-debuginfoUpgrade runc-debugsourceUpgrade runc | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.1.1 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.18-raceUpgrade go1.19-raceUpgrade go1.18-openssl-raceUpgrade go1.18-openssl-docUpgrade go1.18-opensslUpgrade go1.19-docUpgrade go1.18-docUpgrade go1.19Upgrade go1.18 | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.16Upgrade golang-1.18-srcUpgrade golang-1.16-goUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.16-srcUpgrade golang-1.13-src (Ubuntu Pro) | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub