Incorrect sanitization of forwarded query parameters in net/http/httputil
Priority LOW 36CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 23 fixed, 25 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
Why it matters now
EPSS 0.01408 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial net/http/httputil (Go standard library): 1.18.7, 1.19.2Red Hat: 32 advisoriesRed Hat: 23 fixed, 25 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | net/http/httputil | before 1.18.7; 1.19.0-0 to before 1.19.2 | 1.18.7, 1.19.2 | Patch available | CNA |
- net/http/httputil VendorGo standard library Affected before 1.18.7; 1.19.0-0 to before 1.19.2 Fixed in 1.18.7, 1.19.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.18.7; 1.19.0 to before 1.19.2 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.18.7; 1.19.0 to before 1.19.2 Vulnerable ·Go standard library
Remediation
- Fix · CNA net/http/httputil (Go standard library) Fixed in 1.18.7, 1.19.2
Red Hat 32 advisories
- RHSA-2024:3254 Released 2024-05-22 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
- RHSA-2024:2988 Released 2024-05-22 · Red Hat rating Moderatecontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
- RHSA-2024:2944 Released 2024-05-21 · Red Hat rating ImportantAMQ Broker 7.12.0.OPR.1.GA Container Images release and security update
- Middleware Containers for OpenShift amq7/amq-broker-init-rhel8, amq7/amq-broker-rhel8, amq7/amq-broker-rhel8-operator +1
Show 29 more Red Hat advisories
- RHSA-2024:0121 Released 2024-01-10 · Red Hat rating Moderatecontainer-tools:4.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.s390x::container-tools:4.0 +47
- RHSA-2023:4003 Released 2023-07-10 · Red Hat rating ModerateRed Hat Service Interconnect 1.4 Release security update
- Red Hat Service Interconnect skupper-cli-1.4.1-2.el8, skupper-router-2.4.1-2.el8, skupper-router-common-2.4.1-2.el8 +2
- Red Hat Service Interconnect 1 skupper-cli-1.4.1-2.el9, skupper-router-2.4.1-2.el9, skupper-router-common-2.4.1-2.el9 +2
- RHSA-2023:3613 Released 2023-06-26 · Red Hat rating ModerateOpenShift Container Platform 4.12.22 packages and security update
- Red Hat OpenShift Container Platform 4.12 bpftool-4.18.0-372.59.1.el8_6, buildah-1:1.23.4-5.1.rhaos4.12.el8, buildah-1:1.23.4-5.rhaos4.12.el9 +47
- RHSA-2023:3742 Released 2023-06-21 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.13.0 security and bug fix update
- RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
- RHSA-2023:3642 Released 2023-06-15 · Red Hat rating ImportantRed Hat Ceph Storage 6.1 Container security and bug fix update
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
- RHSA-2023:0584 Released 2023-05-18 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.1.1 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2023:3205 Released 2023-05-18 · Red Hat rating ModerateOpenShift Virtualization 4.13.0 Images security, bug fix, and enhancement update
- CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
- RHSA-2023:2780 Released 2023-05-16 · Red Hat rating ModerateImage Builder security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-75-1.el8, osbuild-composer-core-75-1.el8, osbuild-composer-dnf-json-75-1.el8 +2
- RHSA-2023:2784 Released 2023-05-16 · Red Hat rating Moderategrafana security update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.15-4.el8
- RHSA-2023:2866 Released 2023-05-16 · Red Hat rating Moderategit-lfs security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) git-lfs-3.2.0-2.el8
- RHSA-2023:2204 Released 2023-05-09 · Red Hat rating ModerateImage Builder security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-76-2.el9_2, osbuild-composer-core-76-2.el9_2, osbuild-composer-dnf-json-76-2.el9_2 +2
- RHSA-2023:2357 Released 2023-05-09 · Red Hat rating Moderategit-lfs security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.2.0-1.el9
- RHSA-2023:2167 Released 2023-05-09 · Red Hat rating Moderategrafana security and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-9.0.9-2.el9
- RHSA-2023:1275 Released 2023-03-15 · Red Hat rating ImportantRed Hat OpenStack Platform (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-12.el8ost
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-12.el8ost
- RHSA-2023:1174 Released 2023-03-09 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.1.2 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-mustgather-rhel8, oadp/oadp-rhel8-operator +8
- RHSA-2023:1042 Released 2023-03-06 · Red Hat rating ModerateCustom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)
- OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator
- RHSA-2023:0727 Released 2023-02-16 · Red Hat rating ModerateOpenShift Container Platform 4.12.3 security update
- Red Hat OpenShift Container Platform 4.12 buildah-1:1.23.4-4.rhaos4.12.el8, buildah-1:1.23.4-4.rhaos4.12.el9, buildah-tests-1:1.23.4-4.rhaos4.12.el8 +45
- RHSA-2023:0709 Released 2023-02-09 · Red Hat rating ModerateRelease of OpenShift Serverless 1.27.0
- Red Hat OpenShift Serverless 1.27 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8, openshift-serverless-1/client-kn-rhel8 +34
- RHSA-2023:0708 Released 2023-02-09 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.27.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.6.1-1.el8
- RHSA-2023:0693 Released 2023-02-09 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.7 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-openvpn-rhel8 +8
- RHSA-2023:0542 Released 2023-01-30 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.3.1 Containers security update
- RHOSSM 2.3 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/kiali-rhel8 +4
- RHSA-2023:0446 Released 2023-01-25 · Red Hat rating Moderatego-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.src::go-toolset:rhel8, delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.x86_64::go-toolset:rhel8, go-toolset-1.18.9-1.module+el8.7.0+17845+708ebe87.aarch64::go-toolset:rhel8 +18
- RHSA-2023:0445 Released 2023-01-25 · Red Hat rating Moderatego-toolset-1.18 security update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.18-1.18.9-1.el7_9, go-toolset-1.18-build-1.18.9-1.el7_9, go-toolset-1.18-golang-1.18.9-1.el7_9 +8
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.18-1.18.9-1.el7_9, go-toolset-1.18-build-1.18.9-1.el7_9, go-toolset-1.18-golang-1.18.9-1.el7_9 +8
- RHSA-2023:0328 Released 2023-01-23 · Red Hat rating Moderatego-toolset and golang security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) golang-1.18.9-1.el9_1, golang-bin-1.18.9-1.el9_1, golang-docs-1.18.9-1.el9_1 +4
- RHSA-2023:0264 Released 2023-01-19 · Red Hat rating ModerateRed Hat OpenShift (Logging Subsystem) security update
- RHOL 5.6 for RHEL 8 openshift-logging/elasticsearch6-rhel8, openshift-logging/logging-loki-rhel8, openshift-logging/logging-view-plugin-rhel8
- RHSA-2022:7399 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2022:7398 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.12 crudini-0.9.3-4.el9, future-0.18.2-9.el9.1, openstack-ironic-1:21.0.1-0.20221114235951.fe64d5e.el9 +47
- Red Hat OpenShift Container Platform 4.12 NetworkManager-1:1.36.0-8.el8_6, NetworkManager-adsl-1:1.36.0-8.el8_6, NetworkManager-bluetooth-1:1.36.0-8.el8_6 +47
- RHSA-2022:8781 Released 2022-12-08 · Red Hat rating ModerateLogging Subsystem 5.5.5 - Red Hat OpenShift security update
- RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +3
- RHSA-2022:8535 Released 2022-11-24 · Red Hat rating ModerateOpenShift Container Platform 4.11.16 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Application Interconnect 1.0 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Web Terminal | Affected | No fix yet |
| Self Node Remediation Operator | Affected | No fix yet |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| 8Base-OADP-1.1 | Fixed | RHSA-2023:1174 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:0693 |
| CNV 4.13 for RHEL 9 | Fixed | RHSA-2023:3205 |
| Middleware Containers for OpenShift | Fixed | RHSA-2024:2944 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2023:0584 |
| OpenShift Custom Metrics Autoscaler 2 | Fixed | RHSA-2023:1042 |
| RHODF 4.13 for RHEL 9 | Fixed | RHSA-2023:3742 |
| RHOL 5.5 for RHEL 8 | Fixed | RHSA-2022:8781 |
| RHOL 5.6 for RHEL 8 | Fixed | RHSA-2023:0264 |
| RHOSSM 2.3 for RHEL 8 | Fixed | RHSA-2023:0542 |
| Red Hat Ceph Storage 6.1 Tools | Fixed | RHSA-2023:3642 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2023:0445 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2023:0445 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:0446, RHSA-2023:2780, RHSA-2023:2784, RHSA-2023:2866, RHSA-2024:0121, RHSA-2024:2988, RHSA-2024:3254 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:0328, RHSA-2023:2167, RHSA-2023:2204, RHSA-2023:2357 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:8535 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2022:7398, RHSA-2022:7399, RHSA-2023:0727, RHSA-2023:3613 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2023:0708 |
| Red Hat OpenShift Serverless 1.27 | Fixed | RHSA-2023:0709 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2023:1275 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2023:1275 |
| Red Hat Service Interconnect | Fixed | RHSA-2023:4003 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2023:4003 |
Not affected: 21 products
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- Ironic content for Red Hat OpenShift Container Platform 4.12
- Middleware Containers for OpenShift
- OSSO 1.1 for RHEL 8
- OpenShift Custom Metrics Autoscaler 2
- RHODF 4.13 for RHEL 9
- RHOL 5.5 for RHEL 8
- RHOL 5.6 for RHEL 8
- RHOSSM 2.3 for RHEL 8
- Red Hat Ceph Storage 6.1 Tools
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift distributed tracing 2
- Red Hat Service Interconnect
- Red Hat Service Interconnect 1
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2880
- 2026-10-03 Alias added: GHSA-m3hq-grv6-h853
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-2880 · CVE Program
- CVE-2022-2880 · NVD
- FIRST EPSS
- GHSA-m3hq-grv6-h853 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-2880 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences