The IETF has published RFC 10008, which defines a new HTTP method called QUERY. This is the first addition to the standard set of HTTP verbs since PATCH arrived in 2010. The method is described as occupying a grey zone between GET and POST, meaning it may carry both parameters and a body, but its semantics are not fully settled.
For security professionals, the introduction of a new method is noteworthy because it expands the attack surface. Existing web servers, proxies, and firewalls may not recognize QUERY and could mishandle it, potentially leading to request smuggling, cache poisoning, or bypasses of access controls. The SANS ISC diary highlights this uncertainty, noting that the method's ambiguous nature could be exploited before tooling and best practices catch up.
While the source does not provide specific attack scenarios, it underscores the need for defenders to monitor how their infrastructure treats QUERY requests. Until implementations mature, administrators should review whether their systems reject, forward, or process this method, and consider whether any existing rules need adjustment to avoid unintended behavior.