Search: CVE-2026-39825

CVE-2026-39825 is a medium severity vulnerability in the Go standard library's net/http/httputil ReverseProxy component. It involves inconsistent parsing of HTTP query parameters, where some parameters may be hidden from certain functions like Rewrite or Director but still forwarded by ReverseProxy. This leads to inconsistent interpretation of HTTP requests, classified as HTTP Request/Response Smuggling (CWE-444). No official patch or remediation guidance has been published, and no known exploits exist in the wild.