A vulnerability classified as problematic was found in net-http-httputil up to 1.25.9/1.26.2 on Go. This impacts the function
Rewrite of the component Query Parameter Handler. Executing a manipulation can lead to http request smuggling.
This vulnerability is tracked as CVE-2026-39825. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is advised.
