NewsPublished 19 Sep 2026

HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)

Source SANS ISC Handlers Diary

Description

In June 2026, the IETF published RFC 10008 defining a new HTTP method called QUERY, which behaves like a GET request with a body. This method is safe, idempotent, and cacheable, but many existing web infrastructure controls do not recognize it, potentially allowing bypasses of security mechanisms such as WAFs, CSRF protections, and caching rules. Various servers and frameworks handle QUERY inconsistently, with some rejecting it outright and others passing it through without inspection. The new method is not yet widely used but poses a risk due to gaps in existing security controls that assume a fixed set of HTTP verbs.

Impact

The primary impact is the potential for security control bypasses due to QUERY requests carrying payloads that are not inspected by WAFs or other middleware expecting only known HTTP methods. This can lead to undetected injection attacks (e.g., SQLi, XSS) if signatures are bound to POST bodies only. Additionally, caching systems that do not key on the full request body may serve malicious QUERY responses to unintended users, causing cache poisoning. CSRF protections that do not consider QUERY as a state-changing method may allow unauthorized actions. The inconsistent handling of QUERY across servers and frameworks increases the risk of unpredictable security gaps.

Defensive guidance

Security teams should update all HTTP method pattern matching rules, WAF signatures, API gateway allowlists, and CSRF middleware to explicitly recognize and handle the QUERY method alongside GET and POST. Review and adjust caching configurations to ensure QUERY requests are properly keyed and cached or not cached as appropriate. Monitor vendor advisories and framework updates for official support and patches related to QUERY. Since QUERY is new and not yet widely adopted, proactive configuration changes are recommended to prevent accidental bypasses. No official patches are applicable as this is a protocol-level addition, but configuration and rule updates are necessary.

Summary

RFC 10008 introduces the QUERY HTTP method, a hybrid between GET and POST that carries its query in the request body rather than the URL. It is designed to be safe and idempotent, allowing caching and repeated requests without side effects. However, many security controls like WAFs, API gateways, CSRF middleware, and caching mechanisms are not updated to recognize QUERY, leading to potential inspection bypasses and cache poisoning. Different web servers and frameworks show inconsistent support, with some rejecting QUERY requests and others forwarding them without filtering. The method is supported by some clients and proxies but is not yet popular or fully integrated into all HTTP infrastructure. This creates a risk that malicious payloads sent via QUERY could evade detection if security rules only inspect traditional methods like POST.

References

isc.sans.edu/diary/rss/33352 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Sep 2026, 05:01 UTC

References

Community reviews