PT-2026-38566 · Unknown+1 · Reverseproxy+1

Neild

·

CVE-2026-39825

·

Published

2026-04-25

·

Updated

2026-07-13

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ReverseProxy (affected versions not specified)
Description ReverseProxy can forward queries containing parameters that are not visible to Rewrite functions. When utilizing a Rewrite function or a Director function that parses query parameters, ReverseProxy sanitizes the forwarded request by removing parameters not parsed by url.ParseQuery. However, it fails to account for the total query parameter limit defined by GODEBUG=urlmaxqueryparams=N. This allows a request to forward a parameter, such as hidden=y, while keeping it hidden from the proxy's Rewrite function by exceeding the parameter limit with other entries.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-08060
BIT-GOLANG-2026-39825
CLEANSTART-2026-AI19652
CLEANSTART-2026-AN32474
CLEANSTART-2026-AP10784
CLEANSTART-2026-AP81049
CLEANSTART-2026-AP95632
CLEANSTART-2026-AQ65185
CLEANSTART-2026-AY89602
CLEANSTART-2026-BA41349
CLEANSTART-2026-BD19566
CLEANSTART-2026-BD49035
CLEANSTART-2026-BG69533
CLEANSTART-2026-BG93699
CLEANSTART-2026-BJ92729
CLEANSTART-2026-BM12601
CLEANSTART-2026-BM78291
CLEANSTART-2026-BN09969
CLEANSTART-2026-BN28456
CLEANSTART-2026-BP02821
CLEANSTART-2026-BR79647
CLEANSTART-2026-BS27946
CLEANSTART-2026-BX78383
CLEANSTART-2026-CD71342
CLEANSTART-2026-CD91667
CLEANSTART-2026-CF88804
CLEANSTART-2026-CH40794
CLEANSTART-2026-CH64198
CLEANSTART-2026-CK61704
CLEANSTART-2026-CL67452
CLEANSTART-2026-CN27900
CLEANSTART-2026-CP01923
CLEANSTART-2026-CP20786
CLEANSTART-2026-CR00119
CLEANSTART-2026-DA99134
CLEANSTART-2026-DH72490
CLEANSTART-2026-DM19620
CLEANSTART-2026-DX24417
CLEANSTART-2026-EA12165
CLEANSTART-2026-EI06494
CLEANSTART-2026-EU52554
CLEANSTART-2026-FC24138
CLEANSTART-2026-FF85222
CLEANSTART-2026-FH24210
CLEANSTART-2026-FM92468
CLEANSTART-2026-FP26400
CLEANSTART-2026-FR50160
CLEANSTART-2026-GB02436
CLEANSTART-2026-GB36430
CLEANSTART-2026-GB38700
CLEANSTART-2026-GB83728
CLEANSTART-2026-GE45898
CLEANSTART-2026-GJ69402
CLEANSTART-2026-GK50991
CLEANSTART-2026-GM82388
CLEANSTART-2026-GQ00159
CLEANSTART-2026-GR41888
CLEANSTART-2026-GU95761
CLEANSTART-2026-GY66569
CLEANSTART-2026-GY76045
CLEANSTART-2026-GZ11549
CLEANSTART-2026-GZ35045
CLEANSTART-2026-HJ72983
CLEANSTART-2026-HM31566
CLEANSTART-2026-IH16568
CLEANSTART-2026-IM39799
CLEANSTART-2026-IP78312
CLEANSTART-2026-IT06487
CLEANSTART-2026-IV00591
CLEANSTART-2026-IW91368
CLEANSTART-2026-JB18761
CLEANSTART-2026-JL47330
CLEANSTART-2026-JO51351
CLEANSTART-2026-JQ70227
CLEANSTART-2026-JT15863
CLEANSTART-2026-JV11945
CLEANSTART-2026-JY63142
CLEANSTART-2026-KA21986
CLEANSTART-2026-KD85000
CLEANSTART-2026-KF61159
CLEANSTART-2026-KJ73757
CLEANSTART-2026-KK19266
CLEANSTART-2026-KL61187
CLEANSTART-2026-KO66630
CLEANSTART-2026-KZ96078
CLEANSTART-2026-LA67881
CLEANSTART-2026-LA96053
CLEANSTART-2026-LC57158
CLEANSTART-2026-LG16061
CLEANSTART-2026-LG79681
CLEANSTART-2026-LI56163
CLEANSTART-2026-LN66182
CLEANSTART-2026-LY44407
CLEANSTART-2026-MA49342
CLEANSTART-2026-MA83809
CLEANSTART-2026-ME88121
CLEANSTART-2026-MI06133
CLEANSTART-2026-MI82983
CLEANSTART-2026-MJ60235
CLEANSTART-2026-MK07381
CLEANSTART-2026-ML42911
CLEANSTART-2026-MO16862
CLEANSTART-2026-MR08661
CLEANSTART-2026-MR50866
CLEANSTART-2026-MV81821
CLEANSTART-2026-MX15076
CLEANSTART-2026-MX56097
CLEANSTART-2026-MZ00063
CLEANSTART-2026-NT10973
CLEANSTART-2026-NT30039
CLEANSTART-2026-NU38786
CLEANSTART-2026-OB67529
CLEANSTART-2026-OD56729
CLEANSTART-2026-OF37807
CLEANSTART-2026-OF46770
CLEANSTART-2026-OF83437
CLEANSTART-2026-OH26633
CLEANSTART-2026-OH43332
CLEANSTART-2026-OH87240
CLEANSTART-2026-OI68686
CLEANSTART-2026-ON19155
CLEANSTART-2026-OO10146
CLEANSTART-2026-OR40192
CLEANSTART-2026-OS93204
CLEANSTART-2026-OV11554
CLEANSTART-2026-OV19069
CLEANSTART-2026-OV95289
CLEANSTART-2026-OX06093
CLEANSTART-2026-OX51942
CLEANSTART-2026-OY74734
CLEANSTART-2026-PB32291
CLEANSTART-2026-PK19530
CLEANSTART-2026-PL75416
CLEANSTART-2026-PQ10269
CLEANSTART-2026-PU75130
CLEANSTART-2026-PV53006
CLEANSTART-2026-PX23055
CLEANSTART-2026-PX55932
CLEANSTART-2026-QL45485
CLEANSTART-2026-QN79037
CLEANSTART-2026-QO29688
CLEANSTART-2026-QO30809
CLEANSTART-2026-QP84300
CLEANSTART-2026-QR52625
CLEANSTART-2026-QS87161
CLEANSTART-2026-QU83011
CLEANSTART-2026-QU88766
CLEANSTART-2026-QU97327
CLEANSTART-2026-RD75979
CLEANSTART-2026-RE02723
CLEANSTART-2026-RF77222
CLEANSTART-2026-RF96040
CLEANSTART-2026-RQ86436
CLEANSTART-2026-RT07393
CLEANSTART-2026-RX06063
CLEANSTART-2026-RY70255
CLEANSTART-2026-RZ44006
CLEANSTART-2026-RZ88142
CLEANSTART-2026-SA78596
CLEANSTART-2026-SE34232
CLEANSTART-2026-SE90004
CLEANSTART-2026-SF49994
CLEANSTART-2026-SL86558
CLEANSTART-2026-SP45896
CLEANSTART-2026-SQ76279
CLEANSTART-2026-SW10568
CLEANSTART-2026-SY48547
CLEANSTART-2026-TB18047
CLEANSTART-2026-TD06078
CLEANSTART-2026-TD94714
CLEANSTART-2026-TG81541
CLEANSTART-2026-TH33219
CLEANSTART-2026-TK06108
CLEANSTART-2026-TL66481
CLEANSTART-2026-TO13966
CLEANSTART-2026-UC73978
CLEANSTART-2026-UF28691
CLEANSTART-2026-UK19445
CLEANSTART-2026-UL50886
CLEANSTART-2026-UO11850
CLEANSTART-2026-UR38994
CLEANSTART-2026-UV44995
CLEANSTART-2026-UY49411
CLEANSTART-2026-VD47610
CLEANSTART-2026-VE68915
CLEANSTART-2026-VJ54611
CLEANSTART-2026-VN16911
CLEANSTART-2026-VO11205
CLEANSTART-2026-VR76068
CLEANSTART-2026-VU08393
CLEANSTART-2026-VW96633
CLEANSTART-2026-VX15911
CLEANSTART-2026-WB86581
CLEANSTART-2026-WE55349
CLEANSTART-2026-WK17839
CLEANSTART-2026-WK82561
CLEANSTART-2026-WS85269
CLEANSTART-2026-WV75091
CLEANSTART-2026-WW69050
CLEANSTART-2026-WW79343
CLEANSTART-2026-XC13942
CLEANSTART-2026-XI63678
CLEANSTART-2026-XJ06210
CLEANSTART-2026-XK25146
CLEANSTART-2026-XP01012
CLEANSTART-2026-XQ84127
CLEANSTART-2026-XS86531
CLEANSTART-2026-XV43582
CLEANSTART-2026-XV65906
CLEANSTART-2026-XY20765
CLEANSTART-2026-YB92538
CLEANSTART-2026-YF30779
CLEANSTART-2026-YG71543
CLEANSTART-2026-YH23797
CLEANSTART-2026-YK91867
CLEANSTART-2026-YP16651
CLEANSTART-2026-YP80658
CLEANSTART-2026-YY48565
CLEANSTART-2026-YZ69292
CLEANSTART-2026-ZA63260
CLEANSTART-2026-ZE01287
CLEANSTART-2026-ZF00349
CLEANSTART-2026-ZH72202
CLEANSTART-2026-ZK33776
CLEANSTART-2026-ZK75486
CLEANSTART-2026-ZN45188
CLEANSTART-2026-ZN46983
CLEANSTART-2026-ZR76960
CLEANSTART-2026-ZW09225
CLEANSTART-2026-ZX52017
CVE-2026-39825
GO-2026-4976
OPENSUSE-SU-2026:10723-1
OPENSUSE-SU-2026:10741-1
OPENSUSE-SU-2026:20762-1
OPENSUSE-SU-2026:20763-1
OPENSUSE-SU-2026:21254-1
OPENSUSE-SU-2026:21319-1
RHSA-2026:23262
RHSA-2026:23264
SUSE-SU-2026:1861-1
SUSE-SU-2026:1862-1
SUSE-SU-2026:2078-1
SUSE-SU-2026:2079-1
SUSE-SU-2026:2092-1
SUSE-SU-2026:2093-1
SUSE-SU-2026:21804-1
SUSE-SU-2026:21805-1
SUSE-SU-2026:22572-1
SUSE-SU-2026:22638-1

Affected Products

Red Os
Reverseproxy