ReverseProxy in Go's net/http/httputil does not honor the urlmaxqueryparams limit set via GODEBUG when sanitizing query strings. As a result, a client can send a request containing more query parameters than permitted, and the proxy will discriminate only the ones parsed by url.ParseQuery, silently forwarding the rest. This flaw represents improper input validation and can let an attacker inject hidden data that bypasses rewrite or director logic, potentially leaking sensitive information or altering upstream behavior.

Every Go runtime that ships with the unpatched ReverseProxy implementation is affected. Applications that use the standard net/http/httputil ReverseProxy without adding their own input‑validation layer or custom sanitization are susceptible. The flaw is present in all releases before any future patch that addresses this behavior.

The CVSS score of 5.3 indicates moderate severity, and an EPSS score of less than 1 % suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is network where an attacker crafts HTTP requests containing excessive query parameters sent to the reverse proxy. The exploit is local to the proxy’s request handling, requiring no privileged state beyond typical network access. Because the flaw hinges on an unbounded query parameter list, the practical impact depends on the downstream service’s handling of the forwarded parameters, but it can result in hidden data being processed or unexpected upstream actions.