A New HTTP Method Enters the Scene: The Risks of QUERY in Web Infrastructure
The HTTP protocol has just gained a new verb, QUERY, which sits between GET and POST in terms of functionality. This new method was recently standardized by the IETF in RFC 10008, and while it may seem like a minor addition to the HTTP landscape, its implications are significant for web security professionals.
QUERY is essentially a GET request with a body, making it cacheable and safe by design. However, this new behavior creates a gray zone between traditional GET and POST requests, which can lead to inconsistent handling in various web infrastructure components. As a result, old control mechanisms, such as Web Application Firewalls (WAFs), API-gateway allowlists, CSRF middleware, and load-balancer method handling, may not account for QUERY requests.
This oversight can have serious consequences. If WAF signatures are tied to “POST” bodies but not trained on “QUERY” payloads, attackers can exploit this gap by sending malicious queries over the new HTTP method. Researchers have already demonstrated that a malicious payload sent via “QUERY” can bypass signature-based detection when compared to the same payload sent via “POST”.
Furthermore, because QUERY is cacheable and safe, caching mechanisms may inadvertently serve user-specific payloads to other users if they don’t properly key on the full request body. Similarly, CSRF middleware hardcoded to traditional state-changing verbs will allow unintended side effects from “QUERY” endpoints.
As the adoption of QUERY begins to increase, web security professionals must update their rules and regexes to account for this new verb. The inclusion of http.method in (“GET”, “POST”, “QUERY”) in WAF configurations is a crucial step towards mitigating potential risks.
Interestingly, most modern malware detection relies on behavioral analysis rather than method-specific signatures. As such, the introduction of QUERY does not significantly change the risk landscape from a malware perspective, as beaconing analysis and other techniques remain effective regardless of the HTTP verb used.
In conclusion, while the addition of QUERY to the HTTP protocol may seem minor at first glance, its impact on web security is significant. Web infrastructure components must be updated to accommodate this new behavior, and security professionals should exercise vigilance in monitoring for potential abuse of this new method. As always, staying ahead of emerging threats requires a proactive approach to security, including regular updates to detection mechanisms and thorough testing of systems against new attack vectors.
Source: SANS ISC — 2026-09-19