{"id":"CVE-2026-56866","kind":"vulnerability","aliases":["CVE-2026-56866","GO-2026-6605"],"related":[],"title":"HTTP/1 client connection desynchronization after CONNECT rejection in net/http","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.","summary":"Go's net/http HTTP/1 client can leave a pooled connection desynchronized after a CONNECT request with a body is rejected by the server, because the body bytes are sent unframed and may be read by the server as a second request. An attacker who can influence requests through a shared client or reverse proxy can get the next caller to receive a response meant for someone else.","severity":"high","cvss":7.5,"epss":0.00309,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.9","1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","httputil.reverseproxy","reverse-proxy","runtime","shared-transport"],"not_affected_if":["default-config","http2-only","no-connect-forwarding"],"how_to_check":"Check whether the Go toolchain or module that builds the service is at go1.26.9 or go1.27.2 or later, or run `go version` on the build host.\nFind services that forward CONNECT through a shared http.Transport, such as httputil.ReverseProxy with CONNECT support.","fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:07+00:00","updated_at":"2026-10-23T19:56:07+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T19:56:07Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild.\nunknown","summary":"Go's net/http HTTP/1 client can leave a pooled connection desynchronized after a CONNECT request with a body is rejected by the server, because the body bytes are sent unframed and may be read by the server as a second request. An attacker who can influence requests through a shared client or reverse proxy can get the next caller to receive a response meant for someone else.","category":"runtime","who_cares":["go","reverse-proxy","httputil.ReverseProxy","shared-transport"],"confidence":0.8,"analyst_note":"Confirm from GO-2026-6605 whether non-CONNECT requests with bodies are affected and whether the fix is in a patch release for other supported Go lines; check the NVD page for CVSS vector.","how_to_check":"Check whether the Go toolchain or module that builds the service is at go1.26.9 or go1.27.2 or later, or run `go version` on the build host.\nFind services that forward CONNECT through a shared http.Transport, such as httputil.ReverseProxy with CONNECT support.\nunknown","needs_analyst":true,"not_affected_if":["no-connect-forwarding","http2-only","default-config"],"severity_if_unknown":"unknown"},"cost_usd":0.000452,"input_tokens":2268,"output_tokens":450,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A,17A '-56866':12A,18A '-6605':15A '2xx':134C 'aliv':137C 'attack':71B 'bodi':46B,54B,112C,155C,162C 'byte':55B,163C 'caller':87B,182C 'caus':179C 'client':2A,33B,79B 'connect':3A,6A,38B,42B,101C,116C,128C,142C,148C,172C,176C,201C 'cross':212C 'cross-us':211C 'cve':10A,16A 'desynchron':4A,39B,177C 'direct':113C 'els':95B 'empti':107C 'forward':200C 'frame':118C 'get':84B 'go':13A,20B,29B 'header':122C 'http.transport':97C 'http/1':1A,32B,100C 'http/1.1':168C 'httputil.reverseproxy':21B,198C 'idl':145C 'includ':197C 'influenc':74B 'inject':192C 'interpret':159C 'keep':136C 'keep-al':135C 'lead':209C 'leav':35B,173C 'may':60B,158C 'meant':92B 'net/http':9A,31B 'next':86B,181C 'non':106C,133C 'non-2xx':132C 'non-empti':105C 'pipelin':167C 'poison':215C 'pool':37B,146C,175C 'proxi':24B,82B,196C 'read':62B,187C 'receiv':89B 'reject':7A,48B,126C 'request':43B,69B,75B,102C,121C,129C,149C,154C,169C,193C,202C 'request.body':108C 'respons':91B,138C,189C,214C 'return':140C 'reus':184C 'revers':23B,81B,195C 'reverse-proxi':22B 'runtim':25B 'second':68B 'send':98C 'sent':57B 'server':51B,65B,125C,157C 'share':27B,78B,205C 'shared-transport':26B 'someon':94B 'stdlib':19A 'subsequ':166C 'trail':161C 'transport':28B,139C,206C 'unfram':58B 'user':213C 'without':117C 'write':110C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6605","url":"https://pkg.go.dev/vuln/GO-2026-6605","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-56866","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56866","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-56866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56866","severity":null,"published_at":"2026-10-08T23:17:01+00:00","modified_at":"2026-10-09T16:35:35+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}