onyx --cves cve-2022-2880

CVE-2022-2880

HIGHPOCGo

score: <0.1
cvss: 7.5
epss: 1.4%
published: 2022-10-14
kev added: —
first seen: 2026-10-21

Go net/http ReverseProxy contains a query parameter smuggling vulnerability caused by forwarding raw, unparsable query parameters from inbound requests, letting attackers manipulate request parsing, exploit requires attacker to send unparsable parameters.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2022-10-14 Published
2026-10-21 Tracked by Onyx
2026-10-21 Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-444

References 5

https://go.dev/cl/432976
https://pkg.go.dev/vuln/GO-2022-1038
https://go.dev/issue/54663
https://groups.google.com/g/golang-announce/c/xtuG5faxtaU
https://security.gentoo.org/glsa/202311-09