Cyber Resilience

CVE-2026-39825

Golang Go ≤ 1.25.10

Published
07 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0039 32th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-39825 is a medium-severity an unspecified weakness vulnerability in Golang Go. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery.…

more

ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Vulnerability in public-facing ReverseProxy enables bypass of Rewrite/Director parameter visibility and sanitization, directly facilitating exploitation of the exposed application.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-68121Same product: Golang Go
CVE-2026-32280Same product: Golang Go
CVE-2026-39823Same product: Golang Go
CVE-2026-39826Same product: Golang Go
CVE-2026-32289Same product: Golang Go
CVE-2025-61726Same product: Golang Go
CVE-2026-27143Same product: Golang Go
CVE-2026-32282Same product: Golang Go
CVE-2026-27138Same product: Golang Go
CVE-2023-29409Same product: Golang Go

Affected Assets

golang
go
≤ 1.25.10 · 1.26.0 — 1.26.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-4 Information Flow Enforcement
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of all input query parameters so that hidden or unparsed values (bypassing Rewrite/Director logic) are rejected before forwarding.

AC-4 Information Flow Enforcement good match
prevent

Enforces strict information-flow rules on HTTP requests, ensuring only explicitly parsed and authorized query parameters cross the ReverseProxy boundary.

SC-7 Boundary Protection partial match
prevent

Boundary-protection mechanisms at the proxy can be configured to block or sanitize malformed query strings that exploit ParseQuery limits.

References