ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade goUpgrade rclone | May 20, 2026 | May 7, 2026 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golang-testsUpgrade soci-snapshotterUpgrade golang-docsUpgrade golang-binUpgrade runcUpgrade dockerUpgrade golangUpgrade amazon-ecr-credential-helper-debuginfoUpgrade containerd-stressUpgrade nerdctl-debuginfoUpgrade golistUpgrade runc-debuginfoUpgrade amazon-ecr-credential-helperUpgrade amazon-cloudwatch-agentUpgrade docker-debuginfoUpgrade oci-add-hooksUpgrade ecs-initUpgrade runfinch-finchUpgrade oci-add-hooks-debuginfoUpgrade golist-debuginfoUpgrade golang-srcUpgrade containerd-debuginfoUpgrade golang-sharedUpgrade containerdUpgrade nerdctl | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade nerdctlUpgrade containerd-stress-debuginfoUpgrade oci-add-hooks-debuginfoUpgrade containerdUpgrade docker-debuginfoUpgrade golang-docsUpgrade runc-debuginfoUpgrade runfinch-finchUpgrade runc-debugsourceUpgrade amazon-ecr-credential-helperUpgrade golistUpgrade docker-debugsourceUpgrade golang-sharedUpgrade credentials-fetcherUpgrade golist-debuginfoUpgrade containerd-debuginfoUpgrade containerd-stressUpgrade ecs-initUpgrade soci-snapshotterUpgrade golang-miscUpgrade dockerUpgrade golist-debugsourceUpgrade containerd-debugsourceUpgrade oci-add-hooksUpgrade golang-srcUpgrade golang-binUpgrade golang-testsUpgrade oci-add-hooks-debugsourceUpgrade runcUpgrade golang | May 28, 2026 | May 7, 2026 |
| Oracle_linux | — | Upgrade golang-docsUpgrade golang-binUpgrade golang-testsUpgrade go-toolsetUpgrade golang-miscUpgrade golangUpgrade golang-raceUpgrade delveUpgrade golang-src | Jun 5, 2026 | May 7, 2026 |
| Redhat_linux | — | Upgrade go-toolsetUpgrade delve-debuginfoUpgrade golangNo solution existsUpgrade golang-srcUpgrade golang-binUpgrade golang-docsUpgrade golang-miscUpgrade golang-raceUpgrade delve-debugsourceUpgrade golang-testsUpgrade delve | Jul 17, 2026 | May 7, 2026 |
| Rocky_linux | — | Upgrade delveUpgrade go-toolsetUpgrade delve-debugsourceUpgrade golangUpgrade delve-debuginfoUpgrade golang-raceUpgrade golang-bin | Aug 27, 2026 | Aug 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | May 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub