Live › vulnerability › CVE-2026-56866
Go to dashboardGo's net/http HTTP/1 client can leave a pooled connection desynchronized after a CONNECT request with a body is rejected by the server, because the body bytes are sent unframed and may be read by the server as a second request. An attacker who can influence requests through a shared client or reverse proxy can get the next caller to receive a response meant for someone else.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| stdlib | go | >= 1.27.0-0, < 1.27.2 | 1.26.9, 1.27.2 |
Check whether the Go toolchain or module that builds the service is at go1.26.9 or go1.27.2 or later, or run go version on the build host.
Find services that forward CONNECT through a shared http.Transport, such as httputil.ReverseProxy with CONNECT support.
Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.
This page as .md · .json · in your agent: get_signal("CVE-2026-56866")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.