Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade toolboxUpgrade udicaUpgrade crunUpgrade podman-testsUpgrade conmonUpgrade skopeoUpgrade criu-develUpgrade podman-dockerUpgrade weldr-clientUpgrade podman-pluginsUpgrade slirp4netnsUpgrade golang-raceUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-workerUpgrade runcUpgrade critUpgrade podmanUpgrade grafanaUpgrade container-selinuxUpgrade python3-podmanUpgrade python3-criuUpgrade libslirpUpgrade git-lfsUpgrade podman-gvproxyUpgrade delveUpgrade skopeo-testsUpgrade golang-docsUpgrade golang-miscUpgrade podman-catatonitUpgrade netavarkUpgrade osbuild-composer-coreUpgrade buildah-testsUpgrade toolbox-testsUpgrade golang-testsUpgrade osbuild-composerUpgrade buildahUpgrade go-toolsetUpgrade containers-commonUpgrade criuUpgrade cockpit-podmanUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade aardvark-dnsUpgrade libslirp-develUpgrade criu-libsUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade golang-binUpgrade golangUpgrade golang-src | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade golangUpgrade golang-srcUpgrade golang-docsUpgrade golang-binUpgrade golang-raceUpgrade golang-sharedUpgrade golang-misc | Apr 21, 2023 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-testsUpgrade golang-miscUpgrade golang-binUpgrade golang-raceUpgrade golang-srcUpgrade golang-docsUpgrade golangUpgrade golang-shared | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade osbuild-composer-debugsourceUpgrade libslirp-debuginfoUpgrade podman-dockerUpgrade python3-criuUpgrade runcUpgrade skopeo-testsUpgrade podman-debuginfoUpgrade podman-remoteUpgrade weldr-client-debuginfoUpgrade crun-debuginfoUpgrade aardvark-dnsUpgrade git-lfs-debuginfoUpgrade runc-debugsourceUpgrade slirp4netns-debuginfoUpgrade osbuildUpgrade udicaUpgrade slirp4netns-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade crun-debugsourceUpgrade criu-libs-debuginfoUpgrade osbuild-composer-workerUpgrade osbuild-luks2Upgrade podman-gvproxyUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-debuginfoUpgrade critUpgrade toolbox-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade toolbox-debugsourceUpgrade osbuild-selinuxUpgrade libslirp-develUpgrade criu-develUpgrade podman-debugsourceUpgrade criu-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debugsourceUpgrade osbuild-composer-worker-debuginfoUpgrade grafanaUpgrade golang-docsUpgrade go-toolsetUpgrade cockpit-podmanUpgrade git-lfsUpgrade python3-osbuildUpgrade runc-debuginfoUpgrade osbuild-composerUpgrade golang-binUpgrade podman-plugins-debuginfoUpgrade weldr-clientUpgrade conmon-debuginfoUpgrade delveUpgrade buildah-testsUpgrade containers-commonUpgrade grafana-debugsourceUpgrade weldr-client-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debuginfoUpgrade libslirpUpgrade fuse-overlayfs-debuginfoUpgrade conmonUpgrade buildah-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade osbuild-composer-dnf-jsonUpgrade podman-remote-debuginfoUpgrade grafana-debuginfoUpgrade golang-srcUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debugsourceUpgrade buildah-tests-debuginfoUpgrade golang-miscUpgrade osbuild-lvm2Upgrade python3-podmanUpgrade podmanUpgrade buildahUpgrade osbuild-ostreeUpgrade netavarkUpgrade osbuild-composer-core-debuginfoUpgrade delve-debuginfoUpgrade slirp4netnsUpgrade osbuild-composer-coreUpgrade skopeo-debugsourceUpgrade skopeoUpgrade podman-testsUpgrade git-lfs-debugsourceUpgrade fuse-overlayfsUpgrade crunUpgrade criu-libsUpgrade buildah-debugsourceUpgrade toolbox-testsUpgrade golang-testsUpgrade toolboxUpgrade podman-pluginsUpgrade podman-catatonitUpgrade weldr-client-tests-debuginfoUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade cockpit-composerUpgrade delve-debugsourceUpgrade golang-raceUpgrade golangUpgrade criu | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go118Upgrade go119 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golangUpgrade golang-src | Mar 9, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Jan 9, 2023 | Oct 14, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade python3-podmanUpgrade conmonUpgrade go-toolsetUpgrade delveUpgrade critUpgrade criuUpgrade udicaUpgrade podman-catatonitUpgrade criu-develUpgrade container-selinuxUpgrade buildah-testsUpgrade runcUpgrade podman-dockerUpgrade libslirpUpgrade skopeo-testsUpgrade osbuild-composer-workerUpgrade cockpit-composerUpgrade golang-raceUpgrade cockpit-podmanUpgrade podman-pluginsUpgrade podman-testsUpgrade crunUpgrade slirp4netnsUpgrade osbuild-luks2Upgrade golang-docsUpgrade weldr-clientUpgrade python3-criuUpgrade golang-testsUpgrade podman-gvproxyUpgrade osbuildUpgrade git-lfsUpgrade buildahUpgrade golang-binUpgrade osbuild-ostreeUpgrade libslirp-develUpgrade golang-srcUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade golang-miscUpgrade osbuild-selinuxUpgrade fuse-overlayfsUpgrade containers-commonUpgrade grafanaUpgrade osbuild-composerUpgrade python3-osbuildUpgrade golangUpgrade osbuild-composer-dnf-jsonUpgrade podmanUpgrade criu-libsUpgrade osbuild-lvm2Upgrade netavarkUpgrade osbuild-composer-coreUpgrade skopeoUpgrade aardvark-dnsUpgrade podman-remote | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade conmonUpgrade openshift-clientsUpgrade podmanUpgrade ignitionUpgrade skopeoUpgrade buildah | Jan 18, 2023 | Oct 4, 2022 |
| Redhat_linux | — | Upgrade buildah-tests-debuginfoUpgrade critUpgrade aardvark-dnsUpgrade osbuild-composerUpgrade delve-debuginfoUpgrade golang-docsUpgrade cockpit-composerUpgrade osbuild-composer-tests-debuginfoUpgrade podman-catatonitUpgrade criu-debugsourceUpgrade podman-pluginsUpgrade crun-debugsourceUpgrade osbuild-composer-coreUpgrade criu-develUpgrade golang-binUpgrade podmanUpgrade criuUpgrade git-lfs-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade golang-testsUpgrade podman-debuginfoUpgrade osbuild-lvm2Upgrade containers-commonUpgrade libslirp-develUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade runcUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade delveUpgrade fuse-overlayfs-debugsourceUpgrade osbuild-composer-workerUpgrade toolboxUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade criu-libsUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade osbuild-ostreeUpgrade delve-debugsourceUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-worker-debuginfoUpgrade toolbox-debuginfoUpgrade runc-debugsourceUpgrade slirp4netns-debuginfoUpgrade golang-srcUpgrade podman-debugsourceUpgrade python3-criuUpgrade osbuildUpgrade python3-osbuildUpgrade criu-debuginfoUpgrade golangUpgrade weldr-client-debuginfoUpgrade skopeoUpgrade podman-remoteUpgrade podman-gvproxy-debuginfoUpgrade golang-miscUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade netavarkUpgrade osbuild-selinuxUpgrade toolbox-debugsourceUpgrade podman-remote-debuginfoUpgrade buildah-debugsourceUpgrade podman-dockerUpgrade buildah-debuginfoUpgrade grafanaUpgrade container-selinuxUpgrade buildah-testsUpgrade conmonUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade git-lfsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-testsUpgrade go-toolsetUpgrade libslirp-debugsourceUpgrade conmon-debuginfoUpgrade grafana-debuginfoUpgrade fuse-overlayfsUpgrade git-lfs-debugsourceUpgrade conmon-debugsourceUpgrade weldr-clientUpgrade cockpit-podmanNo solution existsUpgrade weldr-client-tests-debuginfoUpgrade crun-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade crunUpgrade weldr-client-debugsourceUpgrade udicaUpgrade toolbox-testsUpgrade osbuild-luks2Upgrade osbuild-composer-debuginfoUpgrade golang-raceUpgrade skopeo-debugsourceUpgrade skopeo-debuginfoUpgrade libslirpUpgrade osbuild-composer-debugsourceUpgrade grafana-debugsourceUpgrade podman-gvproxyUpgrade buildahUpgrade python3-podman | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade libslirpUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debuginfoUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade crun-debuginfoUpgrade fuse-overlayfsUpgrade crunUpgrade podman-pluginsUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonit-debuginfoUpgrade netavarkUpgrade podman-testsUpgrade buildahUpgrade buildah-debugsourceUpgrade skopeo-debuginfoUpgrade conmonUpgrade podman-catatonitUpgrade criuUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debuginfoUpgrade criu-libsUpgrade containers-commonUpgrade delve-debugsourceUpgrade skopeo-debugsourceUpgrade golang-raceUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debugsourceUpgrade libslirp-develUpgrade delve-debuginfoUpgrade podmanUpgrade skopeoUpgrade golangUpgrade crun-debugsourceUpgrade critUpgrade toolbox-testsUpgrade runcUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-remoteUpgrade golang-binUpgrade criu-develUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade runc-debuginfoUpgrade podman-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade runc-debugsourceUpgrade python3-criuUpgrade delveUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade criu-debugsourceUpgrade toolbox-debuginfoUpgrade conmon-debuginfoUpgrade go-toolsetUpgrade libslirp-debugsourceUpgrade buildah-testsUpgrade slirp4netns-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade aardvark-dns | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.18-openssl-raceUpgrade go1.19-raceUpgrade go1.18-raceUpgrade go1.18-openssl-docUpgrade go1.18Upgrade go1.18-opensslUpgrade go1.19Upgrade go1.18-docUpgrade go1.19-doc | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.13-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.13-goUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.18Upgrade golang-1.18-srcUpgrade golang-1.16-goUpgrade golang-1.16-src | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub