Golang ReverseProxy Denial of Service Vulnerability

Description

Requests forwarded by ReverseProxy included the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory.

Affected Applications

Go Programming Language

CVE References

CVE-2022-41715 CVE-2022-2880

Other References

https://groups.google.com/g/golang-announce/c/xtuG5faxtaU