RFC 10008 introduces the QUERY HTTP method, a hybrid between GET and POST that carries its query in the request body rather than the URL. It is designed to be safe and idempotent, allowing caching and repeated requests without side effects. However, many security controls like WAFs, API gateways, CSRF middleware, and caching mechanisms are not updated to recognize QUERY, leading to potential inspection bypasses and cache poisoning. Different web servers and frameworks show inconsistent support, with some rejecting QUERY requests and others forwarding them without filtering. The method is supported by some clients and proxies but is not yet popular or fully integrated into all HTTP infrastructure. This creates a risk that malicious payloads sent via QUERY could evade detection if security rules only inspect traditional methods like POST.

The primary impact is the potential for security control bypasses due to QUERY requests carrying payloads that are not inspected by WAFs or other middleware expecting only known HTTP methods. This can lead to undetected injection attacks (e.g., SQLi, XSS) if signatures are bound to POST bodies only. Additionally, caching systems that do not key on the full request body may serve malicious QUERY responses to unintended users, causing cache poisoning. CSRF protections that do not consider QUERY as a state-changing method may allow unauthorized actions. The inconsistent handling of QUERY across servers and frameworks increases the risk of unpredictable security gaps.

Security teams should update all HTTP method pattern matching rules, WAF signatures, API gateway allowlists, and CSRF middleware to explicitly recognize and handle the QUERY method alongside GET and POST. Review and adjust caching configurations to ensure QUERY requests are properly keyed and cached or not cached as appropriate. Monitor vendor advisories and framework updates for official support and patches related to QUERY. Since QUERY is new and not yet widely adopted, proactive configuration changes are recommended to prevent accidental bypasses. No official patches are applicable as this is a protocol-level addition, but configuration and rule updates are necessary.