Executive brief
A vulnerability in the Go programming language's standard library affects applications using its built-in reverse proxy functionality. An attacker can craft a web request with a very large number of parameters to bypass security filters or routing rules defined by the proxy. This could allow unauthorized parameters to reach backend servers, potentially leading to unauthorized data access or unintended application behavior.
Technical details
The net/http/httputil.ReverseProxy implementation fails to account for the url.ParseQuery limit (controlled by GODEBUG=urlmaxqueryparams) when sanitizing requests. When a request contains more query parameters than the defined limit, the proxy's Rewrite or Director functions only see the parameters up to the limit, while the full original query string may be forwarded to the backend. An attacker can exploit this by padding a request with thousands of dummy parameters to 'push' a sensitive parameter (e.g., 'admin=true' or 'hidden=y') past the limit, making it invisible to security logic in the proxy but visible to the destination server. This issue is fixed in Go versions 1.25.10 and 1.26.3.
Affected products
- Google Go < 1.25.10, >= 1.26.0 < 1.26.3
Timeline
- 2026-04-24: other: Issue opened on GitHub
- 2026-05-07: disclosed: Vulnerability published
- 2026-05-07: advisory: Go Project advisory issued