ReverseProxy in Go's net/http/httputil does not honor the urlmaxqueryparams limit set via GODEBUG when sanitizing query strings. As a result, a request can carry a large number of query parameters while only a subset is processed by Rewrite or Director logic. The excess parameters are silently forwarded to the upstream server, allowing an attacker to inject hidden data that bypasses the proxy's sanitization routine. This flaw represents improper input validation (CWE‑20) and can lead to confidentiality or integrity violations by exposing hidden query values or enabling unauthorized request manipulation.

All releases of the Go standard library that include the net/http/httputil ReverseProxy implementation and do not contain a specific fix for this issue. Applications that rely on the default ReverseProxy behavior without custom sanitization or input validation are potentially affected.

The vulnerability can be exploited by forging an HTTP request with more query parameters than the configured urlmaxqueryparams value; the attacker can embed hidden parameters that survive sanitization. While EPSS is not available and the issue is not listed in CISA KEV, the simplicity of the exploit and the fact that query‑parameter limits are often set to high values suggest a non‑trivial risk. Without an official patch operators must mitigate by enforcing their own limits at the application or edge layer and monitoring for future fixes in Go releases.