CVE-2026-94439

UNKNOWN 0.0

HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

Vendor	go standard library
Product	net/http
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for go standard library net/http

Be the first to know when new unknown vulnerabilities affecting go standard library net/http are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Go standard library / net/http

0 < 1.26.9 1.27.0-0 < 1.27.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

go.dev: https://go.dev/cl/847311 go.dev: https://go.dev/issue/81744 groups.google.com: https://groups.google.com/g/golang-announce/c/U2fTuyDJznI pkg.go.dev: https://pkg.go.dev/vuln/GO-2026-6613

Credits

Jakub Ciolek (https://ciolek.dev)