Critical, CVSS 9.4GoPublished
S3-Proxy has Security Issues in its Resource Path Matching Implementation
CVE-2026-42882 · GHSA-rfgq-wgg8-662p
- Affected
- Go github.com/oxyno-zeta/s3-proxy < 0.0.0-20260424211602-1320e4abd46a
- Fixed in
- 0.0.0-20260424211602-1320e4abd46a· Vendor fix available
- Issue
- Background The original concern is functional: a resource pattern should treat a percent-encoded segment like some%2Fvalue as a single opaque token rather than splitting it into two path segments at the decoded /. Investigation into why %2F was being decoded and how routes matched against the result surfaced three related security issues, documented below. Rather than landing a fix directly, the problem space warrants discussion first. Different fixes carry different compliance and compatibility tradeoffs, and every viable option is a breaking change in some form. Aligning on a direction before committing to an implementation is the safer path. Root cause: two different path representations Go's net/http decodes percent-encoded characters when it parses an incoming URL: %2F becomes / in r.URL.Path, while the original encoded form is preserved in r.URL.RawPath. Two different parts of s3-proxy use different fields: - The auth middleware calls r.URL.RequestURI(), which returns the…
Recommended action: Upgrade to 0.0.0-20260424211602-1320e4abd46a (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.