CVE-2026-39825

A flaw was found in the net/http/httputil package, specifically within the ReverseProxy component. This vulnerability allows the ReverseProxy to forward query parameters that are not visible to Rewrite functions. This occurs because the ReverseProxy does not correctly consider the url.ParseQuery limit on the total number of query parameters. A remote attacker could exploit this to send hidden query parameters, potentially bypassing security policies or controls implemented by Rewrite functions, leading to information disclosure or unexpected behavior.

A flaw was found in Go's net/http/httputil package where ReverseProxy can forward query parameters that are hidden from Rewrite or Director functions. This occurs when the number of query parameters exceeds the url.ParseQuery limit (controlled by the GODEBUG setting urlmaxqueryparams). While Red Hat ships Go-based components across many products, exploitation requires that an application use ReverseProxy with a Rewrite or Director function that relies on query parameter inspection for security enforcement, which limits the practical impact of this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Increase the maximum number of query parameters allowed by setting the GODEBUG environment variable urlmaxqueryparams to a higher value (e.g., GODEBUG=urlmaxqueryparams=20000), or validate and enforce security controls on query parameters at the backend service rather than relying solely on the ReverseProxy's Rewrite or Director function for security filtering.