Medium · 5.3 CVE-2026-39825 BIT-golang-2026-39825EUVD-2026-28425GHSA-h74g-238j-357mGO-2026-4976

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

Published May 7, 2026 · Updated May 8, 2026 · Assigned by Go

Vendor: Go standard library Product: net/http/httputil Package: aactl Package: amazon-cloudwatch-agent Package: amazon-k8s-cni Package: argo-cd-3.3-compat Package: aws-flb-cloudwatch Package: aws-flb-firehose Package: aws-flb-kinesis Package: aws-otel-collector Package: cert-manager-1.20 Package: cert-manager-acmesolver-1.20 Package: cert-manager-cainjector-1.20 Package: cert-manager-controller-1.20 Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: cilium-cli Package: cni-plugins Package: cni-plugins-aws-k8s-compat Package: cni-plugins-ipam Package: cni-plugins-main Package: cni-plugins-meta Package: containerd-1 Package: containerd-shim-runc-v2-1 Package: containerd-stress-1 Package: coredns-1.13 Package: ctr-1 Package: dask-gateway-server Package: datadog-agent-7.72 Package: datadog-agent-7.72-full Package: datadog-agent-7.73 Package: datadog-agent-7.73-full Package: datadog-cluster-agent-7.72 Package: datadog-cluster-agent-7.73 Package: dockerd-29 Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: falco-no-driver Package: fluent-bit-plugin-loki Package: flux-2.7 Package: gitaly-18.11 Package: go Package: go-1.24 Package: go-1.24-asm Package: go-1.24-covdata Package: go-1.24-cover Package: go-1.24-nm Package: go-1.24-objdump Package: go-1.24-test2json Package: go-1.26 Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: gosh Package: gpu-feature-discovery Package: grafana-12.3 Package: grafana-12.4 Package: grafana-13.0 Package: grafana-alloy Package: grafana-mimir-3.0-query-tee-3.0 Package: harbor-2.14 Package: helm-3 Package: hubble Package: juicefs-1.3 Package: k3d Package: k3s Package: k3s-1.32 Package: k3s-1.35 Package: k3s-multicall Package: k3s-multicall-1.32 Package: k3s-multicall-1.34 Package: k3s-multicall-1.35 Package: k3s-static Package: k3s-static-1.32 Package: k3s-static-1.35 Package: kaf Package: karma Package: knative-serving-1.21-activator Package: kots Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-fluentd-operator Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-proxy-1.35-default-compat Package: kube-proxy-1.36 Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-scheduler-1.35-default-compat Package: kube-scheduler-1.36 Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-1.32 Package: kubectl-1.33 Package: kubectl-1.34 Package: kubectl-1.35 Package: kubectl-1.36 Package: kubectl-bash-completion-1.35 Package: kubelet-1.34 Package: kubelet-1.35 Package: kubelet-1.36 Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-dashboard Package: kubernetes-pause-compat-1.35 Package: kubevela-vela-cli Package: kubevela-vela-core Package: kubo Package: kuma-coredns-1.13 Package: kyverno-1.17 Package: kyverno-cli-1.17 Package: libnvidia-container Package: mattermost-11.1 Package: minio Package: nerdctl Package: nvidia-device-plugin Package: prometheus-3.10 Package: prometheus-3.11 Package: prometheus-3.8 Package: prometheus-3.9 Package: prometheus-admission-webhook Package: prometheus-config-reloader Package: prometheus-operator Package: rclone Package: redka Package: runc Package: spqr Package: stdlib Package: teleport-18.6 Package: trino Package: tw Package: victoriametrics Package: victoriametrics-vmselect-cluster Package: vitess-23 Package: vitess-23-binaries Package: zarf Package: zot Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.

Affected products

Vendor	Product	Affected	Fixed
Go standard library	net/http/httputil	< 1.25.10, 1.26.0-0 – < 1.26.3	1.25.10

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	golang-1.26	1.26.3-1	—
Debian 13	golang-1.24	No fix yet	—
Debian 12	golang-1.19	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.04 LTS	golang-1.23 +2	No fix yet	—
Ubuntu 25.10	golang-1.23 +2	No fix yet	—
Ubuntu 24.04 LTS	golang-1.21 +4	No fix yet	—
Ubuntu 22.04 LTS	golang-1.17 +7	No fix yet	—
Ubuntu 20.04 LTS	golang-1.13 +5	No fix yet	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	golang-1.8 +2	No fix yet	—
Ubuntu 16.04 LTS	golang-1.6 +1	No fix yet	—
Ubuntu 14.04 LTS	golang-1.10	No fix yet	—
Ubuntu Pro 22.04 LTS	golang-1.13	No fix yet	—
Ubuntu Pro 20.04 LTS	golang-1.16	No fix yet	—
Ubuntu Pro 18.04 LTS	golang-1.13 +2	No fix yet	—
Ubuntu Pro 16.04 LTS	golang-1.13 +1	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	golang +7	1.26.3-4.el10_2	RHSA-2026:22120
RHEL 9	golang +7	1.26.3-1.el9_8	RHSA-2026:22121
RHEL 8	delve	1.25.2-1.module+el8.10.0+23746+9db33b5e	RHSA-2026:22112
RHEL 8	golang +7	1.25.10-1.module+el8.10.0+24308+5c4a16b7	RHSA-2026:22112

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.0 EUS	golang +7	1.26.5-1.el10_0	RHSA-2026:49702
RHEL 9.6 EUS	golang +7	1.26.5-1.el9_6	RHSA-2026:49712
RHEL 9.4 E4S	golang +7	1.26.5-1.el9_4	RHSA-2026:57649
RHEL 9.2 E4S	golang +7	1.26.5-1.el9_2	RHSA-2026:61253
Red Hat Hardened Images 1	golang1.25 +5	1.25.11-2.hum1	RHSA-2026:23262
Red Hat Hardened Images 1	golang1.26 +5	1.26.4-2.hum1	RHSA-2026:23264

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	golang +7	1.26.3-1.el9_8	ALSA-2026:22121
AlmaLinux 8	delve	1.25.2-1.module_el8.10.0+4074+24330916	ALSA-2026:22112
AlmaLinux 8	golang +7	1.25.10-1.module_el8.10.0+4187+c45165c4	ALSA-2026:22112

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	golang	1.26.3-4.el10_2	RLSA-2026:22120
Rocky Linux 9	golang	1.26.3-1.el9_8	RLSA-2026:22121
Rocky Linux 8	delve	1.25.2-1.module+el8.10.0+40035+ee0a7047	RLSA-2026:22112
Rocky Linux 8	golang	1.25.10-1.module+el8.10.0+40200+0fd0f175	RLSA-2026:22112

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	go1.25-openssl	1.25.12-160000.1.1	SUSE-SU-2026:22638-1
SLES for SAP 16.0	go1.26-openssl	1.26.4-160000.1.1	SUSE-SU-2026:22572-1
SLES 16.0	go1.25-openssl	1.25.12-160000.1.1	SUSE-SU-2026:22638-1
SLES 16.0	go1.26-openssl	1.26.4-160000.1.1	SUSE-SU-2026:22572-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	go1.25	1.25.10-1.1	openSUSE-SU-2026:10723-1
openSUSE Tumbleweed	go1.26	1.26.3-1.1	openSUSE-SU-2026:10741-1
openSUSE Leap 16.0	go1.25-openssl	1.25.12-160000.1.1	openSUSE-SU-2026:21319-1
openSUSE Leap 16.0	go1.26-openssl	1.26.4-160000.1.1	openSUSE-SU-2026:21254-1
openSUSE Leap 16.0	govulncheck-vulndb	0.0.20260723T184607-160000.1.1	openSUSE-SU-2026:21483-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	go	1.26.3-r0	—
Alpine v3.24	rclone	1.74.1-r0	—
Alpine v3.23	go	1.25.10-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	amazon-cloudwatch-agent	1.300066.2-2.amzn2023	ALAS2023-2026-1747
Amazon Linux 2023	amazon-ecr-credential-helper	0.12.0-3.amzn2023	ALAS2023-2026-1738
Amazon Linux 2023	containerd +1	2.2.3-1.amzn2023.0.2	ALAS2023-2026-1737
Amazon Linux 2023	credentials-fetcher	2.0.1-1.amzn2023.0.5	ALAS2023-2026-1744
Amazon Linux 2023	docker	25.0.14-1.amzn2023.0.6	ALAS2023-2026-1736
Amazon Linux 2023	ecs-init	1.103.2-1.amzn2023	ALAS2023-2026-1771
Amazon Linux 2023	golang +6	1.25.10-1.amzn2023.0.1	ALAS2023-2026-1743
Amazon Linux 2023	golang-github-burntsushi-toml +1	1.5.0-1.amzn2023.0.1	ALAS2023-2026-1751
Amazon Linux 2023	golang-github-burntsushi-toml-test +1	0.2.0-8.amzn2023.0.3	ALAS2023-2026-1750
Amazon Linux 2023	golang-github-cpuguy83-md2man +2	2.0.2-24.amzn2023.0.7	ALAS2023-2026-1749
Amazon Linux 2023	golist	0.10.4-12.amzn2023.0.9	ALAS2023-2026-1742
Amazon Linux 2023	nerdctl	2.2.2-1.amzn2023.0.2	ALAS2023-2026-1735
Amazon Linux 2023	oci-add-hooks	0-0.1.20200504git268e3bb.amzn2023.0.11	ALAS2023-2026-1739
Amazon Linux 2023	runc	1.3.4-5.amzn2023.0.2	ALAS2023-2026-1715
Amazon Linux 2023	runfinch-finch	1.17.0-1.amzn2023.0.2	ALAS2023-2026-1741
Amazon Linux 2023	soci-snapshotter	0.13.0-1.amzn2023.0.3	ALAS2023-2026-1740
Amazon Linux 2	amazon-cloudwatch-agent	1.300066.2-2.amzn2	ALAS2-2026-3323
Amazon Linux 2	golang +6	1.25.10-1.amzn2.0.1	ALAS2-2026-3313
Amazon Linux 2	golist	0.10.1-10.amzn2.0.13	ALAS2-2026-3308
Amazon Linux 2	nerdctl	2.2.2-1.amzn2.0.2	ALAS2-2026-3319

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	golang	No fix yet	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	golang +7	1.26.5-1.0.1.el10_2	ELSA-2026-22120
Oracle Linux 9	golang +7	1.26.3-1.0.1.el9_8	ELSA-2026-22121
Oracle Linux 8	delve	1.25.2-1.0.1.module+el8.10.0+90715+2d4d8dfd	ELSA-2026-22112
Oracle Linux 8	golang +7	1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb	ELSA-2026-22112

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	aactl	0.4.12-r50	—
Wolfi rolling	amazon-cloudwatch-agent	1.300067.0-r2	—
Wolfi rolling	amazon-k8s-cni	1.21.1-r6	—
Wolfi rolling	argo-cd-3.3-compat	3.3.9-r2	—
Wolfi rolling	aws-flb-cloudwatch	1.9.5-r1	—
Wolfi rolling	aws-flb-firehose	1.7.3-r1	—
Wolfi rolling	aws-flb-kinesis	1.10.4-r1	—
Wolfi rolling	aws-otel-collector	0.47.0-r12	—
Wolfi rolling	cert-manager-1.20 +5	1.20.2-r3	—
Wolfi rolling	cilium-cli	0.19.2-r11	—
Wolfi rolling	cni-plugins +3	1.9.1-r4	—
Wolfi rolling	cni-plugins-main	1.9.1-r3	—
Wolfi rolling	coredns-1.13 +1	1.13.2-r5	—
Wolfi rolling	ctr-1 +3	1.7.31-r2	—
Wolfi rolling	dask-gateway-server	2026.3.0-r4	—
Wolfi rolling	datadog-agent-7.72 +1	7.72.4-r22	—
Wolfi rolling	datadog-agent-7.73-full +1	7.73.3-r13	—
Wolfi rolling	dockerd-29	29.4.3-r0	—
Wolfi rolling	dogstatsd-7.72 +1	7.72.4-r21	—
Wolfi rolling	dogstatsd-7.73 +1	7.73.3-r12	—
Wolfi rolling	falco-no-driver	0.44.0-r0	—
Wolfi rolling	fluent-bit-plugin-loki	3.7.1-r5	—
Wolfi rolling	flux-2.7	2.7.5-r16	—
Wolfi rolling	gitaly-18.11	18.11.2-r1	—
Wolfi rolling	go-1.24	1.24.13-r0	—
Wolfi rolling	go-1.24-nm +5	No fix yet	—
Wolfi rolling	go-1.26	1.26.3-r0	—
Wolfi rolling	gosh	0.0.47-r0	—
Wolfi rolling	gpu-feature-discovery	0.19.1-r1	—
Wolfi rolling	grafana-12.3	12.3.6.01-r5	—
Wolfi rolling	grafana-12.4	12.4.2-r11	—
Wolfi rolling	grafana-13.0	13.0.1-r3	—
Wolfi rolling	grafana-alloy	1.15.1-r5	—
Wolfi rolling	grafana-mimir-3.0-query-tee-3.0	3.0.6-r2	—
Wolfi rolling	harbor-2.14	2.14.3-r16	—
Wolfi rolling	helm-3	3.20.2-r0	—
Wolfi rolling	hubble	1.19.3-r2	—
Wolfi rolling	juicefs-1.3	1.3.1-r14	—
Wolfi rolling	k3d	5.8.3-r33	—
Wolfi rolling	k3s +1	1.35.3.1-r7	—
Wolfi rolling	k3s-1.32 +1	1.32.13.1-r16	—
Wolfi rolling	k3s-1.35 +2	1.35.3.1-r5	—
Wolfi rolling	k3s-multicall-1.34	1.34.6.1-r6	—
Wolfi rolling	k3s-static	1.35.3.1-r8	—
Wolfi rolling	k3s-static-1.32	1.32.13.1-r15	—
Wolfi rolling	kaf	0.2.14-r3	—
Wolfi rolling	karma	0.129-r3	—
Wolfi rolling	knative-serving-1.21-activator	1.21.3-r7	—
Wolfi rolling	kots	1.130.2-r1	—
Wolfi rolling	kube-fluentd-operator	1.18.2-r63	—
Wolfi rolling	kube-proxy-1.35 +1	1.35.4-r4	—
Wolfi rolling	kube-proxy-1.36 +1	1.36.0-r0	—
Wolfi rolling	kubeadm-1.34 +3	1.34.7-r1	—
Wolfi rolling	kubeadm-1.35 +5	1.35.4-r3	—
Wolfi rolling	kubeadm-1.36 +5	1.36.0-r1	—
Wolfi rolling	kubectl-1.32	1.32.13-r1	—
Wolfi rolling	kubectl-1.33	1.33.11-r1	—
Wolfi rolling	kubectl-1.34 +3	1.34.7-r2	—
Wolfi rolling	kubectl-bash-completion-1.35 +3	1.35.8-r6	—
Wolfi rolling	kubernetes-dashboard	7.14.0-r6	—
Wolfi rolling	kubevela-vela-cli +1	1.10.8-r5	—
Wolfi rolling	kubo	0.41.0-r1	—
Wolfi rolling	kyverno-1.17 +1	1.17.2-r35	—
Wolfi rolling	libnvidia-container	1.19.0-r1	—
Wolfi rolling	mattermost-11.1	11.1.3-r2	—
Wolfi rolling	minio	0.20260504.002721-r1	—
Wolfi rolling	nerdctl	2.2.2-r5	—
Wolfi rolling	nvidia-device-plugin	0.19.1-r0	—
Wolfi rolling	prometheus-3.10	3.10.0-r6	—
Wolfi rolling	prometheus-3.11	3.11.3-r0	—
Wolfi rolling	prometheus-3.8	3.8.1-r4	—
Wolfi rolling	prometheus-3.9	3.9.1-r4	—
Wolfi rolling	prometheus-config-reloader	0.91.0-r0	—
Wolfi rolling	prometheus-operator +1	0.91.0-r1	—
Wolfi rolling	redka	1.0.1-r1	—
Wolfi rolling	runc	1.4.2-r2	—
Wolfi rolling	spqr	2.9.0-r7	—
Wolfi rolling	teleport-18.6	18.6.8-r13	—
Wolfi rolling	trino	480-r15	—
Wolfi rolling	tw	0.0.47-r1	—
Wolfi rolling	victoriametrics	1.143.0-r0	—
Wolfi rolling	victoriametrics-vmselect-cluster	1.142.0-r2	—
Wolfi rolling	vitess-23	23.0.4-r0	—
Wolfi rolling	vitess-23-binaries	23.0.4-r1	—
Wolfi rolling	zarf	0.75.1-r0	—
Wolfi rolling	zot	2.1.16-r3	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	stdlib	< 1.25.10 · >= 1.26.0-0, < 1.26.3	1.25.10, 1.26.3	GO-2026-4976

Advisories 47

WID-SEC-2026-2455 Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
WID-SEC-2026-1437 Golang Go: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
ALSA-2026:22121 Important: golang security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:22112 Important: go-toolset:rhel8 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:61253 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:57649 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:49712 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:49702 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:23264 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:23262 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:22120 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:22121 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:22112 Red Hat Security Advisory: go-toolset:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RLSA-2026:22112 Important: go-toolset:rhel8 security update Rocky Linux Security Advisories · Aug 26, 2026
RLSA-2026:22120 Important: golang security update Rocky Linux Security Advisories · Aug 26, 2026
RLSA-2026:22121 Important: golang security update Rocky Linux Security Advisories · Aug 26, 2026
openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
ELSA-2026-22120 Important: golang security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 21, 2026
SUSE-SU-2026:22638-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Jul 17, 2026
openSUSE-SU-2026:21319-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Jul 15, 2026
SUSE-SU-2026:22572-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Jul 15, 2026
openSUSE-SU-2026:21254-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Jul 9, 2026
ALAS2023-2026-1747 Important: amazon-cloudwatch-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 6, 2026
ALAS2-2026-3323 Important: amazon-cloudwatch-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 6, 2026
ELSA-2026-22121 Important: golang security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
ELSA-2026-22112 Important: go-toolset:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 2, 2026
ALAS2-2026-3308 Important: golist security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2-2026-3313 Important: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2-2026-3319 Important: nerdctl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1741 Important: runfinch-finch security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1742 Important: golist security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1715 Important: runc security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1735 Important: nerdctl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1743 Important: golang security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1736 Important: docker security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1744 Important: credentials-fetcher security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1737 Important: containerd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1738 Important: amazon-ecr-credential-helper security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1749 Important: golang-github-cpuguy83-md2man security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1739 Important: oci-add-hooks security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1750 Important: golang-github-burntsushi-toml-test security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1740 Important: soci-snapshotter security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1751 Important: golang-github-burntsushi-toml security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1771 Important: ecs-init security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 25, 2026
openSUSE-SU-2026:10741-1 go1.26-1.26.3-1.1 on GA media SUSE / openSUSE Security Updates · May 11, 2026
openSUSE-SU-2026:10723-1 go1.25-1.25.10-1.1 on GA media SUSE / openSUSE Security Updates · May 9, 2026

EUVD	v3.1	5.3
CISA-ADP	v3.1	5.3

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Affected packages

Advisories 47

References