--- id: CVE-2026-39825 title: >- net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2… summary: >- A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs becaus… severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N' cvssSource: vendor cwe: CWE-472 vendor: Red Hat product: Red Hat OpenShift Container Platform 4.22 affected: - assisted_installer_for_red_hat_openshift_container_platform 2 - builds_for_red_hat_openshift - cert_manager_operator_for_red_hat_openshift - compliance_operator - confidential_compute_attestation - cryostat 4 - custom_metric_autoscaler_operator_for_red_hat_openshift - deployment_validation_operator - external_secrets_operator_for_red_hat_openshift - fence_agents_remediation_operator - file_integrity_operator - logging_subsystem_for_red_hat_openshift - logical_volume_manager_storage - migration_toolkit_for_applications 8 - migration_toolkit_for_containers - multiarch_tuning_operator - multicluster_engine_for_kubernetes - multicluster_global_hub - network_observability_operator - node_healthcheck_operator - openshift_developer_tools_and_services - openshift_lightspeed - openshift_pipelines - openshift_serverless - openshift_service_mesh 3 - power_monitoring_for_red_hat_openshift - 3scale_api_management_platform 2 - advanced_cluster_management_for_kubernetes 2 - advanced_cluster_security 4 - ansible_automation_platform 2 - ceph_storage 5 - ceph_storage 6 - ceph_storage 9 - certification_program_for_red_hat_enterprise_linux 9 - connectivity_link 1 - developer_hub - edge_manager 1 - enterprise_linux 10 - enterprise_linux 7 - enterprise_linux 8 patched: - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - openshift_api_for_data_protection 1.6 - hardened_images - openshift_container_platform 4.22 - openshift_service_mesh 3.0 - openshift_service_mesh 3.1 - openshift_service_mesh 3.2 - openshift_service_mesh 3.3 - openshift_service_mesh 3.4 - multicluster_engine_for_kubernetes 2.11 published: '2026-05-07' updated: '2026-09-25' sourceUpdated: '2026-09-25T03:47:24+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39825.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39825.json - url: 'https://access.redhat.com/security/cve/CVE-2026-39825' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2467823' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-39825' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-39825' - url: 'https://go.dev/cl/770541' - url: 'https://go.dev/issue/78948' - url: 'https://groups.google.com/g/golang-announce/c/qcCIEXso47M' - url: 'https://pkg.go.dev/vuln/GO-2026-4976' - url: 'https://access.redhat.com/errata/RHSA-2026:49702' - url: 'https://access.redhat.com/errata/RHSA-2026:22120' - url: 'https://access.redhat.com/errata/RHSA-2026:22112' - url: 'https://access.redhat.com/errata/RHSA-2026:61253' - url: 'https://access.redhat.com/errata/RHSA-2026:57649' - url: 'https://access.redhat.com/errata/RHSA-2026:49712' - url: 'https://access.redhat.com/errata/RHSA-2026:22121' - url: 'https://access.redhat.com/errata/RHSA-2026:43692' - url: 'https://access.redhat.com/errata/RHSA-2026:23262' - url: 'https://access.redhat.com/errata/RHSA-2026:23264' - url: 'https://access.redhat.com/errata/RHSA-2026:63096' - url: 'https://access.redhat.com/errata/RHSA-2026:65106' - url: 'https://access.redhat.com/errata/RHSA-2026:65112' - url: 'https://access.redhat.com/errata/RHSA-2026:65113' - url: 'https://access.redhat.com/errata/RHSA-2026:65115' - url: 'https://access.redhat.com/errata/RHSA-2026:65121' - url: 'https://access.redhat.com/errata/RHSA-2026:57194' - url: 'https://access.redhat.com/errata/RHSA-2026:59556' tags: - csaf - vex - red-hat - osv - go epss: 0.00413 epssPercentile: 0.32721 aliases: - GO-2026-4976 - BIT-golang-2026-39825 ecosystem: go ingestedAt: '2026-08-26T19:27:02.291Z' --- ## Overview A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs because the `ReverseProxy` does not correctly consider the `url.ParseQuery` limit on the total number of query parameters. A remote attacker could exploit this to send hidden query parameters, potentially bypassing security policies or controls implemented by `Rewrite` functions, leading to information disclosure or unexpected behavior. ## Vendor advisories - **RHSA-2026:49702** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49702) - **RHSA-2026:22120** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22120) - **RHSA-2026:22112** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22112) - **RHSA-2026:61253** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61253) - **RHSA-2026:57649** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57649) - **RHSA-2026:49712** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49712) - **RHSA-2026:22121** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22121) - **RHSA-2026:43692** · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43692) - **RHSA-2026:23262** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23262) - **RHSA-2026:23264** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23264) - **RHSA-2026:63096** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:63096) - **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Cryostat 4, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, … · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39825.json) - **RHSA-2026:57194** · Red Hat · fixed in: multicluster engine for Kubernetes 2.11 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57194) **net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls** — rated Moderate by Red Hat. Released 2026-05-07, updated 2026-09-25. Affected: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Builds for Red Hat OpenShift - cert-manager Operator for Red Hat OpenShift - Compliance Operator - Confidential Compute Attestation - Cryostat 4 - Custom Metric Autoscaler operator for Red Hat Openshift - Deployment Validation Operator - External Secrets Operator for Red Hat OpenShift - Fence Agents Remediation Operator - File Integrity Operator - Logging Subsystem for Red Hat OpenShift - Logical Volume Manager Storage - Migration Toolkit for Applications 8 - Migration Toolkit for Containers - Multiarch Tuning Operator - Multicluster Engine for Kubernetes - Multicluster Global Hub - Network Observability Operator - Node HealthCheck Operator - OpenShift Developer Tools and Services - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Serverless - OpenShift Service Mesh 3 - Power monitoring for Red Hat OpenShift - Red Hat 3scale API Management Platform 2 - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat Ansible Automation Platform 2 - Red Hat Ceph Storage 5 - Red Hat Ceph Storage 6 - Red Hat Ceph Storage 9 - Red Hat Certification Program for Red Hat Enterprise Linux 9 - Red Hat Connectivity Link 1 - Red Hat Developer Hub - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 7 - Red Hat Enterprise Linux 8 Fixed: - Red Hat Enterprise Linux AppStream EUS (v. 10.0) - Red Hat Enterprise Linux AppStream (v. 10) - Red Hat Enterprise Linux AppStream (v. 8) - Red Hat Enterprise Linux AppStream E4S (v.9.2) - Red Hat Enterprise Linux AppStream E4S (v.9.4) - Red Hat Enterprise Linux AppStream EUS (v.9.6) - Red Hat Enterprise Linux AppStream (v. 9) - OpenShift API for Data Protection 1.6 - Red Hat Hardened Images - Red Hat OpenShift Container Platform 4.22 - Red Hat OpenShift Service Mesh 3.0 - Red Hat OpenShift Service Mesh 3.1 - Red Hat OpenShift Service Mesh 3.2 - Red Hat OpenShift Service Mesh 3.3 - Red Hat OpenShift Service Mesh 3.4 - multicluster engine for Kubernetes 2.11 No fix planned: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Builds for Red Hat OpenShift - cert-manager Operator for Red Hat OpenShift - Compliance Operator - Confidential Compute Attestation - Cryostat 4 - Custom Metric Autoscaler operator for Red Hat Openshift - Deployment Validation Operator - External Secrets Operator for Red Hat OpenShift - Fence Agents Remediation Operator - File Integrity Operator - Logging Subsystem for Red Hat OpenShift - Logical Volume Manager Storage - Migration Toolkit for Applications 8 - Migration Toolkit for Containers - Multiarch Tuning Operator - Multicluster Engine for Kubernetes - Multicluster Global Hub - Network Observability Operator - Node HealthCheck Operator - OpenShift Developer Tools and Services - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Serverless - OpenShift Service Mesh 3 - Power monitoring for Red Hat OpenShift - Red Hat 3scale API Management Platform 2 - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat Ansible Automation Platform 2 - Red Hat Ceph Storage 5 - Red Hat Ceph Storage 6 - Red Hat Ceph Storage 9 - Red Hat Certification Program for Red Hat Enterprise Linux 9 - Red Hat Connectivity Link 1 - Red Hat Developer Hub - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 7 - Red Hat Enterprise Linux 8 Not affected: - OpenShift API for Data Protection 1.6 - Red Hat OpenShift Container Platform 4.22 - Red Hat OpenShift Service Mesh 3.0 - Red Hat OpenShift Service Mesh 3.1 - Red Hat OpenShift Service Mesh 3.2 - Red Hat OpenShift Service Mesh 3.3 - Red Hat OpenShift Service Mesh 3.4 - multicluster engine for Kubernetes 2.11 ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:49702 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22120 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22112 Workarounds / mitigations: - Increase the maximum number of query parameters allowed by setting the GODEBUG environment variable `urlmaxqueryparams` to a higher value (e.g., `GODEBUG=urlmaxqueryparams=20000`), or validate and enforce security controls on query parameters at the backend service rather than relying solely on the ReverseProxy's Rewrite or Director function for security filtering. ## Package advisory (CVE-2026-39825) Affected packages: - `stdlib >= 1.26.0-0, < 1.26.3` Patched in: - `stdlib 1.26.3` Source: https://osv.dev/vulnerability/GO-2026-4976