Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade containernetworking-pluginsUpgrade toolbox-testsUpgrade golangUpgrade go-toolsetUpgrade aardvark-dnsUpgrade golang-binUpgrade fuse-overlayfsUpgrade golang-miscUpgrade criuUpgrade cockpit-podmanUpgrade golang-srcUpgrade podman-catatonitUpgrade osbuild-composerUpgrade netavarkUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade osbuild-composer-coreUpgrade buildah-testsUpgrade golang-testsUpgrade libslirp-develUpgrade buildahUpgrade podman-remoteUpgrade criu-libsUpgrade golang-docsUpgrade delveUpgrade podman-dockerUpgrade libslirpUpgrade toolboxUpgrade podman-gvproxyUpgrade crunUpgrade critUpgrade podman-testsUpgrade udicaUpgrade golang-raceUpgrade osbuild-composer-workerUpgrade slirp4netnsUpgrade weldr-clientUpgrade conmonUpgrade skopeo-testsUpgrade osbuild-composer-dnf-jsonUpgrade podmanUpgrade python3-criuUpgrade grafanaUpgrade skopeoUpgrade python3-podmanUpgrade criu-develUpgrade runcUpgrade container-selinuxUpgrade git-lfsUpgrade podman-plugins | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-raceUpgrade golang-miscUpgrade golang-sharedUpgrade golangUpgrade golang-docsUpgrade golang-binUpgrade golang-srcUpgrade golang-tests | Apr 21, 2023 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-miscUpgrade golang-binUpgrade golang-testsUpgrade golang-raceUpgrade golang-srcUpgrade golang-docsUpgrade golangUpgrade golang-shared | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade toolbox-debugsourceUpgrade grafana-debugsourceUpgrade libslirp-debugsourceUpgrade podman-debuginfoUpgrade runc-debugsourceUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade container-selinuxUpgrade git-lfs-debuginfoUpgrade criu-debugsourceUpgrade osbuild-selinuxUpgrade udicaUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade crun-debugsourceUpgrade conmon-debuginfoUpgrade runc-debuginfoUpgrade critUpgrade skopeo-debuginfoUpgrade git-lfsUpgrade toolbox-debuginfoUpgrade osbuild-composer-workerUpgrade osbuild-luks2Upgrade weldr-clientUpgrade golang-docsUpgrade osbuild-composerUpgrade podman-plugins-debuginfoUpgrade go-toolsetUpgrade python3-osbuildUpgrade golang-binUpgrade delveUpgrade buildah-testsUpgrade podman-gvproxyUpgrade osbuild-composer-worker-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade grafanaUpgrade libslirp-debuginfoUpgrade criu-libs-debuginfoUpgrade libslirp-develUpgrade slirp4netns-debuginfoUpgrade criu-develUpgrade crun-debuginfoUpgrade runcUpgrade podman-dockerUpgrade python3-criuUpgrade weldr-client-debuginfoUpgrade podman-debugsourceUpgrade podman-remoteUpgrade skopeo-testsUpgrade aardvark-dnsUpgrade containernetworking-plugins-debuginfoUpgrade osbuildUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-lvm2Upgrade golang-miscUpgrade buildah-tests-debuginfoUpgrade python3-podmanUpgrade podmanUpgrade conmonUpgrade podman-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debuginfoUpgrade libslirpUpgrade weldr-client-tests-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade delve-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade delve-debuginfoUpgrade criuUpgrade toolboxUpgrade slirp4netnsUpgrade osbuild-composer-coreUpgrade skopeo-debugsourceUpgrade skopeoUpgrade podman-testsUpgrade git-lfs-debugsourceUpgrade fuse-overlayfsUpgrade crunUpgrade criu-libsUpgrade buildah-debugsourceUpgrade toolbox-testsUpgrade golang-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade golang-raceUpgrade golangUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-debuginfoUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade cockpit-composerUpgrade weldr-client-debugsourceUpgrade podman-catatonitUpgrade buildahUpgrade osbuild-ostreeUpgrade osbuild-composer-core-debuginfoUpgrade netavarkUpgrade grafana-debuginfoUpgrade golang-srcUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debugsource | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go118Upgrade go119 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golangUpgrade golang-src | Mar 9, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jan 9, 2023 | Oct 14, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade golangUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-lvm2Upgrade golang-srcUpgrade buildahUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade golang-miscUpgrade osbuildUpgrade python3-osbuildUpgrade osbuild-composer-coreUpgrade osbuild-selinuxUpgrade podmanUpgrade grafanaUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade osbuild-composerUpgrade netavarkUpgrade osbuild-ostreeUpgrade criu-libsUpgrade containers-commonUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade golang-binUpgrade git-lfsUpgrade aardvark-dnsUpgrade golang-raceUpgrade crunUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade osbuild-composer-workerUpgrade skopeo-testsUpgrade criu-develUpgrade runcUpgrade cockpit-composerUpgrade buildah-testsUpgrade critUpgrade udicaUpgrade criuUpgrade podman-dockerUpgrade container-selinuxUpgrade python3-podmanUpgrade osbuild-luks2Upgrade libslirpUpgrade delveUpgrade golang-testsUpgrade conmonUpgrade podman-testsUpgrade podman-pluginsUpgrade podman-catatonitUpgrade golang-docsUpgrade go-toolsetUpgrade weldr-clientUpgrade python3-criuUpgrade podman-gvproxy | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade conmonUpgrade skopeoUpgrade ignitionUpgrade buildahUpgrade openshift-clientsUpgrade podman | Jan 18, 2023 | Oct 4, 2022 |
| Redhat_linux | — | Upgrade cockpit-podmanUpgrade udicaUpgrade podman-dockerUpgrade crun-debuginfoUpgrade weldr-client-tests-debuginfoUpgrade golang-raceUpgrade containernetworking-plugins-debugsourceUpgrade crunUpgrade skopeo-debugsourceUpgrade conmon-debuginfoUpgrade grafana-debuginfoUpgrade libslirp-debugsourceUpgrade skopeo-debuginfoUpgrade grafanaUpgrade buildahUpgrade container-selinuxUpgrade buildah-testsUpgrade podman-testsUpgrade buildah-debuginfoUpgrade osbuild-luks2Upgrade grafana-debugsourceUpgrade libslirpUpgrade weldr-client-debugsourceUpgrade git-lfs-debugsourceUpgrade weldr-clientNo solution existsUpgrade conmon-debugsourceUpgrade go-toolsetUpgrade toolbox-testsUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade podman-gvproxyUpgrade conmonUpgrade osbuild-composer-debugsourceUpgrade git-lfsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python3-podmanUpgrade osbuild-composer-debuginfoUpgrade fuse-overlayfsUpgrade toolboxUpgrade critUpgrade osbuild-composer-worker-debuginfoUpgrade weldr-client-debuginfoUpgrade osbuild-composerUpgrade buildah-tests-debuginfoUpgrade runcUpgrade delve-debuginfoUpgrade golang-miscUpgrade podman-catatonit-debuginfoUpgrade cockpit-composerUpgrade osbuild-composer-core-debuginfoUpgrade podman-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade delve-debugsourceUpgrade buildah-debugsourceUpgrade containers-commonUpgrade criu-libsUpgrade osbuild-selinuxUpgrade podmanUpgrade podman-gvproxy-debuginfoUpgrade netavarkUpgrade podman-remoteUpgrade osbuild-composer-dnf-jsonUpgrade criu-debuginfoUpgrade osbuild-ostreeUpgrade osbuildUpgrade criu-libs-debuginfoUpgrade runc-debugsourceUpgrade podman-remote-debuginfoUpgrade toolbox-debuginfoUpgrade golang-srcUpgrade libslirp-debuginfoUpgrade osbuild-composer-workerUpgrade criu-develUpgrade libslirp-develUpgrade golang-docsUpgrade golangUpgrade skopeo-testsUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade delveUpgrade skopeoUpgrade git-lfs-debuginfoUpgrade golang-testsUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade containernetworking-pluginsUpgrade osbuild-composer-coreUpgrade criu-debugsourceUpgrade podman-pluginsUpgrade podman-debuginfoUpgrade podman-catatonitUpgrade fuse-overlayfs-debugsourceUpgrade golang-binUpgrade crun-debugsourceUpgrade python3-osbuildUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade aardvark-dnsUpgrade osbuild-lvm2Upgrade osbuild-composer-tests-debuginfo | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade conmon-debugsourceUpgrade buildah-debuginfoUpgrade buildah-debugsourceUpgrade buildahUpgrade conmonUpgrade crun-debuginfoUpgrade delve-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade netavarkUpgrade podman-catatonitUpgrade toolboxUpgrade libslirpUpgrade criuUpgrade crunUpgrade delve-debuginfoUpgrade podmanUpgrade podman-pluginsUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade podman-testsUpgrade skopeo-debuginfoUpgrade buildah-tests-debuginfoUpgrade containers-commonUpgrade criu-debuginfoUpgrade skopeo-debugsourceUpgrade criu-libsUpgrade slirp4netnsUpgrade golangUpgrade oci-seccomp-bpf-hookUpgrade golang-raceUpgrade fuse-overlayfs-debugsourceUpgrade skopeoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-gvproxyUpgrade python3-criuUpgrade conmon-debuginfoUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade podman-debuginfoUpgrade runc-debugsourceUpgrade delveUpgrade criu-libs-debuginfoUpgrade criu-debugsourceUpgrade toolbox-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-plugins-debuginfoUpgrade go-toolsetUpgrade golang-binUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-develUpgrade crun-debugsourceUpgrade runcUpgrade podman-remoteUpgrade toolbox-testsUpgrade podman-debugsourceUpgrade buildah-testsUpgrade aardvark-dnsUpgrade slirp4netns-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade toolbox-debugsourceUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade critUpgrade libslirp-debuginfoUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.18Upgrade go1.18-opensslUpgrade go1.19-docUpgrade go1.18-docUpgrade go1.19Upgrade go1.18-raceUpgrade go1.19-raceUpgrade go1.18-openssl-raceUpgrade go1.18-openssl-doc | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.18Upgrade golang-1.16Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.16-srcUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.13-goUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.13-go (Ubuntu Pro) | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub