ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-39825 · Microsoft / collected KEV context

EUVD-2026-28425

GO-2026-4976

BIT-golang-2026-39825

cve-program · CVE-2026-39825

• https://go.dev/cl/770541
• https://go.dev/issue/78948
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4976

euvd · EUVD-2026-28425

• https://go.dev/cl/770541
• https://go.dev/issue/78948
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4976

nvd · CVE-2026-39825

• https://go.dev/cl/770541
• https://go.dev/issue/78948
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4976

osv · GO-2026-4976

• https://go.dev/cl/770541
• https://go.dev/issue/78948
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M

• ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query p… · Advisory content revised · 1 Nov 2026