CVE-2026-39825

{
  "id": "CVE-2026-39825",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-07T20:16:43.390",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function."
    },
    {
      "lang": "es",
      "value": "ReverseProxy puede reenviar consultas que contienen parámetros no visibles para las funciones Rewrite. Cuando se utiliza con una función Rewrite, o una función Director que analiza los parámetros de consulta, ReverseProxy sanea la solicitud reenviada para eliminar los parámetros de consulta que no son analizados por url.ParseQuery. ReverseProxy no tiene en cuenta el límite de ParseQuery sobre el número total de parámetros de consulta (controlado por GODEBUG=urlmaxqueryparams=N). Esto puede permitir a ReverseProxy reenviar una solicitud que contiene un parámetro de consulta que no es visible para la función Rewrite. Por ejemplo, la consulta ’a1=x&a2=x&...&a10000=x&hidden=y’ puede reenviar el parámetro ’hidden=y’ mientras lo oculta de la función Rewrite del proxy."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Go standard library",
          "product": "net/http/httputil",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pkg.go.dev",
          "packageName": "net/http/httputil",
          "programRoutines": [
            {
              "name": "cleanQueryParams"
            },
            {
              "name": "ReverseProxy.ServeHTTP"
            }
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "1.25.10",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.26.0-0",
              "lessThan": "1.26.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-08T16:46:43.329507Z",
          "id": "CVE-2026-39825",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.25.10",
              "matchCriteriaId": "1C966EF3-C51C-4239-B5FC-C44A5202FEC8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.26.0",
              "versionEndExcluding": "1.26.3",
              "matchCriteriaId": "522E4CD0-2B99-4363-9C78-0BAFD988A2D6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://go.dev/cl/770541",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://go.dev/issue/78948",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking"
      ]
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2026-4976",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}