CVE-2022-2880

🗓️ 14 Oct 2022 00:00:00Reported by GoType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 504 Views

Requests forwarded by ReverseProxy include raw query parameters from inbound request, allowing query parameter smuggling. After fix, ReverseProxy sanitizes forwarded query parameters

Reporter	Title	Published	Views	Family All 356
IBM Security Bulletins	Security Bulletin: CVE-2022-2879, CVE-2022-41715, CVE-2022-2880, CVE-2022-41717, CVE-2022-41716 may affect IBM CICS TX Advanced	16 Mar 202315:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to query parameter smuggling in Golang Go (CVE-2022-2880)	1 Feb 202316:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in the mongo-tools utility affect IBM WebSphere Automation	29 Mar 202317:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is affected by multiple vulnerabilities in Golang Go	5 Jul 202321:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	26 Apr 202319:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to multiple software weaknesses due to Golang	4 Apr 202521:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	12 Apr 202320:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	24 Feb 202319:49	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.9 addresses multiple security vulnerabilities.	18 Jul 202313:09	–	ibm
IBM Security Bulletins	Security Bulletin: Operations Dashboard is vulnerable to multiple Go CVEs	5 Jan 202313:12	–	ibm

NVD

Node

golang goRange<1.18.7

golang goRange1.19.0–1.19.2

[
  {
    "vendor": "Go standard library",
    "product": "net/http/httputil",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "net/http/httputil",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.18.7",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.19.0-0",
        "lessThan": "1.19.2",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "ReverseProxy.ServeHTTP"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
go	www.go.dev/cl/432976
security	www.security.gentoo.org/glsa/202311-09
go	www.go.dev/issue/54663
groups	www.groups.google.com/g/golang-announce/c/xtuG5faxtaU
pkg	www.pkg.go.dev/vuln/GO-2022-1038

17 Jun 2026 04:42Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.5

EPSS0.01094

CWE-444