HTTP QUERY Method: The Grey Zone Between GET And POST.

As cited

Copy frozen at 2026-09-18 07:51 UTC (site build).

vulnerabilities

HTTP QUERY Method: The Grey Zone Between GET And POST.

In June 2026 the IETF published RFC 10008, which defines a new HTTP method called QUERY that combines properties of GET and POST by allowing a request body while remaining safe and idempotent. The method sits in a gap between existing HTTP verbs, and current security controls like web application firewalls (WAFs), caches, and middleware were built before QUERY existed and handle it inconsistently, creating potential bypass and poisoning risks. Nginx proxies but never caches QUERY requests, Django rejects them outright, while FastAPI and Caddy pass them through untouched, leaving organizations exposed until rules and configurations are explicitly updated.

Why it matters: Web infrastructure defenders must audit WAF signatures, application programming interface (API) gateway allowlists, CSRF middleware, and cache rules to ensure they inspect QUERY request bodies for injection attacks and prevent cache poisoning, as payloads blocked in POST may bypass detection when sent via QUERY.

Source published

2026-09-18 06:05 UTC

First seen by Cybersecurity Tracker

2026-09-18 06:40 UTC