Parameter Exposure Vulnerability in ReverseProxy by Go

CVE-2026-39825

What is CVE-2026-39825?

The ReverseProxy component in Go has a notable vulnerability that allows it to forward queries containing hidden parameters that are not visible to the Rewrite functions. When integrated with a Rewrite function or a Director function capable of parsing query parameters, ReverseProxy sanitizes forwarded requests by removing parameters not parsed by url.ParseQuery. However, it fails to respect the limits set by GODEBUG=urlmaxqueryparams=N, which can lead to the exposure of query parameters that should remain hidden. This situation can allow malicious actors to exploit exposed parameters, potentially leading to unauthorized access or other security risks.

References