Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade toolbox-testsUpgrade libslirp-develUpgrade golangUpgrade fuse-overlayfsUpgrade osbuild-composer-coreUpgrade buildah-testsUpgrade criu-libsUpgrade buildahUpgrade golang-testsUpgrade go-toolsetUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade aardvark-dnsUpgrade netavarkUpgrade cockpit-podmanUpgrade podman-remoteUpgrade golang-srcUpgrade podman-catatonitUpgrade golang-binUpgrade osbuild-composerUpgrade criuUpgrade containernetworking-pluginsUpgrade golang-miscUpgrade slirp4netnsUpgrade python3-podmanUpgrade toolboxUpgrade criu-develUpgrade crunUpgrade weldr-clientUpgrade skopeoUpgrade podman-pluginsUpgrade git-lfsUpgrade golang-raceUpgrade golang-docsUpgrade podmanUpgrade skopeo-testsUpgrade container-selinuxUpgrade osbuild-composer-workerUpgrade podman-dockerUpgrade conmonUpgrade delveUpgrade udicaUpgrade grafanaUpgrade podman-gvproxyUpgrade osbuild-composer-dnf-jsonUpgrade runcUpgrade libslirpUpgrade python3-criuUpgrade podman-testsUpgrade crit | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-raceUpgrade golang-sharedUpgrade golang-miscUpgrade golang-docsUpgrade golang-testsUpgrade golang-binUpgrade golang-srcUpgrade golang | Apr 21, 2023 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-binUpgrade golang-raceUpgrade golang-miscUpgrade golang-testsUpgrade golangUpgrade golang-sharedUpgrade golang-srcUpgrade golang-docs | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade skopeo-debuginfoUpgrade git-lfs-debuginfoUpgrade containers-commonUpgrade criu-debugsourceUpgrade python3-osbuildUpgrade go-toolsetUpgrade critUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsUpgrade toolbox-debuginfoUpgrade runc-debugsourceUpgrade toolbox-debugsourceUpgrade runc-debuginfoUpgrade cockpit-podmanUpgrade container-selinuxUpgrade podman-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade udicaUpgrade libslirp-debugsourceUpgrade crun-debugsourceUpgrade osbuild-composer-workerUpgrade grafana-debugsourceUpgrade osbuild-luks2Upgrade osbuild-selinuxUpgrade podman-gvproxyUpgrade git-lfsUpgrade golang-docsUpgrade libslirp-debuginfoUpgrade libslirp-develUpgrade grafanaUpgrade slirp4netns-debuginfoUpgrade criu-libs-debuginfoUpgrade criu-develUpgrade crun-debuginfoUpgrade slirp4netns-debugsourceUpgrade osbuild-composer-worker-debuginfoUpgrade conmon-debuginfoUpgrade podman-dockerUpgrade podman-remoteUpgrade podman-debugsourceUpgrade python3-criuUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade runcUpgrade skopeo-testsUpgrade weldr-client-debuginfoUpgrade weldr-clientUpgrade aardvark-dnsUpgrade golang-binUpgrade osbuild-composerUpgrade osbuildUpgrade buildah-testsUpgrade podman-plugins-debuginfoUpgrade delveUpgrade containernetworking-plugins-debugsourceUpgrade cockpit-composerUpgrade delve-debugsourceUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-debuginfoUpgrade criu-debuginfoUpgrade podman-remote-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-lvm2Upgrade golang-miscUpgrade python3-podmanUpgrade podmanUpgrade osbuild-ostreeUpgrade fuse-overlayfs-debugsourceUpgrade netavarkUpgrade grafana-debuginfoUpgrade golang-srcUpgrade buildah-tests-debuginfoUpgrade conmon-debugsourceUpgrade slirp4netnsUpgrade osbuild-composer-coreUpgrade skopeo-debugsourceUpgrade skopeoUpgrade podman-testsUpgrade git-lfs-debugsourceUpgrade fuse-overlayfsUpgrade crunUpgrade criu-libsUpgrade buildah-debugsourceUpgrade toolbox-testsUpgrade golang-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade golang-raceUpgrade golangUpgrade criuUpgrade delve-debuginfoUpgrade toolboxUpgrade podman-pluginsUpgrade podman-catatonitUpgrade fuse-overlayfs-debuginfoUpgrade conmonUpgrade libslirpUpgrade weldr-client-debugsourceUpgrade buildah-debuginfoUpgrade weldr-client-tests-debuginfo | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Mar 9, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jan 9, 2023 | Oct 14, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade crunUpgrade python3-criuUpgrade libslirpUpgrade conmonUpgrade golang-docsUpgrade golang-raceUpgrade podman-pluginsUpgrade golang-testsUpgrade go-toolsetUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade criu-develUpgrade podman-testsUpgrade skopeo-testsUpgrade cockpit-podmanUpgrade cockpit-composerUpgrade osbuild-composer-workerUpgrade slirp4netnsUpgrade critUpgrade runcUpgrade criuUpgrade osbuild-luks2Upgrade udicaUpgrade weldr-clientUpgrade python3-podmanUpgrade buildah-testsUpgrade podman-dockerUpgrade container-selinuxUpgrade delveUpgrade grafanaUpgrade golang-miscUpgrade oci-seccomp-bpf-hookUpgrade python3-osbuildUpgrade containers-commonUpgrade buildahUpgrade skopeoUpgrade aardvark-dnsUpgrade podman-remoteUpgrade golang-binUpgrade git-lfsUpgrade podmanUpgrade criu-libsUpgrade osbuild-selinuxUpgrade osbuild-lvm2Upgrade osbuildUpgrade golang-srcUpgrade containernetworking-pluginsUpgrade osbuild-ostreeUpgrade osbuild-composerUpgrade netavarkUpgrade libslirp-develUpgrade osbuild-composer-coreUpgrade fuse-overlayfsUpgrade osbuild-composer-dnf-jsonUpgrade golang | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade podmanUpgrade skopeoUpgrade openshift-clientsUpgrade ignitionUpgrade buildahUpgrade conmon | Jan 18, 2023 | Oct 4, 2022 |
| Redhat_linux | — | Upgrade conmonUpgrade crun-debuginfoUpgrade crunUpgrade buildahUpgrade weldr-client-tests-debuginfoNo solution existsUpgrade weldr-client-debugsourceUpgrade cockpit-podmanUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netnsUpgrade containernetworking-plugins-debugsourceUpgrade git-lfsUpgrade podman-gvproxyUpgrade podman-testsUpgrade go-toolsetUpgrade golang-raceUpgrade container-selinuxUpgrade weldr-clientUpgrade libslirp-debugsourceUpgrade grafana-debuginfoUpgrade osbuild-composer-debugsourceUpgrade conmon-debugsourceUpgrade libslirpUpgrade git-lfs-debugsourceUpgrade fuse-overlayfsUpgrade skopeo-debuginfoUpgrade conmon-debuginfoUpgrade podman-plugins-debuginfoUpgrade udicaUpgrade podman-dockerUpgrade osbuild-composer-debuginfoUpgrade grafanaUpgrade python3-podmanUpgrade skopeo-debugsourceUpgrade buildah-testsUpgrade grafana-debugsourceUpgrade toolbox-testsUpgrade osbuild-luks2Upgrade buildah-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade osbuild-composer-tests-debuginfoUpgrade delve-debuginfoUpgrade podman-catatonit-debuginfoUpgrade podman-debuginfoUpgrade podmanUpgrade fuse-overlayfs-debugsourceUpgrade aardvark-dnsUpgrade critUpgrade runcUpgrade podman-catatonitUpgrade skopeoUpgrade podman-pluginsUpgrade netavarkUpgrade toolbox-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-remoteUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade criu-libs-debuginfoUpgrade osbuildUpgrade criu-debuginfoUpgrade golang-srcUpgrade runc-debugsourceUpgrade osbuild-ostreeUpgrade osbuild-composer-workerUpgrade osbuild-composer-coreUpgrade criu-develUpgrade libslirp-develUpgrade libslirp-debuginfoUpgrade golang-testsUpgrade git-lfs-debuginfoUpgrade criuUpgrade containernetworking-plugins-debuginfoUpgrade buildah-tests-debuginfoUpgrade osbuild-composerUpgrade podman-debugsourceUpgrade criu-libsUpgrade delveUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade golangUpgrade python3-osbuildUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade weldr-client-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade skopeo-testsUpgrade golang-miscUpgrade cockpit-composerUpgrade golang-docsUpgrade toolbox-debugsourceUpgrade osbuild-selinuxUpgrade toolboxUpgrade python3-criuUpgrade golang-binUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade criu-debugsourceUpgrade delve-debugsourceUpgrade buildah-debugsourceUpgrade crun-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade osbuild-lvm2 | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debugsourceUpgrade netavarkUpgrade podman-pluginsUpgrade criu-debuginfoUpgrade criu-libsUpgrade libslirp-develUpgrade skopeoUpgrade golang-raceUpgrade fuse-overlayfs-debugsourceUpgrade criuUpgrade podmanUpgrade toolboxUpgrade buildah-debuginfoUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade conmon-debugsourceUpgrade conmonUpgrade skopeo-debugsourceUpgrade golangUpgrade crunUpgrade delve-debuginfoUpgrade containers-commonUpgrade skopeo-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-testsUpgrade libslirpUpgrade crun-debuginfoUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonitUpgrade podman-catatonit-debuginfoUpgrade delve-debugsourceUpgrade fuse-overlayfsUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolbox-testsUpgrade critUpgrade containernetworking-pluginsUpgrade delveUpgrade libslirp-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade aardvark-dnsUpgrade slirp4netns-debugsourceUpgrade buildah-testsUpgrade criu-debugsourceUpgrade toolbox-debuginfoUpgrade conmon-debuginfoUpgrade toolbox-debugsourceUpgrade runcUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade golang-binUpgrade crun-debugsourceUpgrade criu-develUpgrade podman-debuginfoUpgrade go-toolsetUpgrade runc-debuginfoUpgrade libslirp-debugsourceUpgrade runc-debugsourceUpgrade python3-criuUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-testsUpgrade podman-debugsourceUpgrade criu-libs-debuginfoUpgrade podman-remote-debuginfo | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.19-raceUpgrade go1.18-openssl-docUpgrade go1.18-openssl-raceUpgrade go1.18-raceUpgrade go1.18Upgrade go1.18-docUpgrade go1.19-docUpgrade go1.19Upgrade go1.18-openssl | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.13-srcUpgrade golang-1.13Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.18-srcUpgrade golang-1.18Upgrade golang-1.18-goUpgrade golang-1.16Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-src | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub