CVE-2022-2880: Vulnerability in net/http/httputil package
Summary
CVE-2022-2880: Incorrect sanitization of forwarded query parameters in net/http/httputil. Affects stdlib across 2 version ranges.
< 1.18.7
>= 1.19.0-0, < 1.19.2
Fixed in 1.18.7 or 1.19.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2022-2880 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/http/httputil package is a part of the Go standard library (stdlib) and provides utilities for working with HTTP requests and responses. It includes functionalities for handling reverse proxies, such as the ReverseProxy.ServeHTTP method. ReverseProxy is used to forward requests to backend servers and includes the raw query parameters from the inbound request. However, prior to the fix, it did not properly sanitize forwarded query parameters, which could lead to query parameter smuggling.
Vulnerability Detail
The vulnerability (CVE-2022-2880) arises from the incorrect sanitization of forwarded query parameters in the net/http/httputil package. When a Go proxy forwards a request with unparsable query parameters, it includes those parameters in the forwarded query. This can be exploited for query parameter smuggling, allowing an attacker to bypass security measures. The fix addresses this issue by sanitizing the query parameters when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies that do not parse query parameters will continue to forward the original query parameters unchanged.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.18.71.18.7go get stdlib@v1.18.7 -
>= 1.19.0-0, < 1.19.21.19.2go get stdlib@v1.19.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can consider implementing additional input validation and sanitization measures in their applications to mitigate the risk of query parameter smuggling.
Conclusion
The vulnerability in the net/http/httputil package (CVE-2022-2880) allows for query parameter smuggling, which can be exploited by attackers. It is crucial to update the affected package to the patched versions (1.18.7 or 1.19.2) of the Go standard library (stdlib) to mitigate this vulnerability. Additionally, implementing proper input validation and sanitization measures can further enhance the security of applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability allows for query parameter smuggling, which can be exploited by attackers to bypass security measures and potentially perform unauthorized actions or access sensitive information.
Versions prior to 1.18.7 and 1.19.2 of the Go standard library (stdlib) are affected by this vulnerability.
There are no known instances of this vulnerability being actively exploited at the time of this report.
Yes, the vulnerability has been patched in versions 1.18.7 and 1.19.2 of the Go standard library (stdlib). Developers should update their applications to use the patched version.
Developers can consider implementing additional input validation and sanitization measures in their applications to mitigate the risk of query parameter smuggling.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
