CVE-2022-2880

Name of the Vulnerable Software and Affected Versions Go versions prior to the fixed version

Description The issue concerns the ReverseProxy in Go, which includes raw query parameters from the inbound request, including unparsable parameters rejected by net/http, potentially permitting query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After the fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy Director function returns, indicating that the proxy has parsed the query parameters. Proxies that do not parse query parameters continue to forward the original query parameters unchanged.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.