---
id: "CVE-2026-56866"
kind: "vulnerability"
aliases: ["CVE-2026-56866", "GO-2026-6605"]
title: "HTTP/1 client connection desynchronization after CONNECT rejection in net/http"
severity: "high"
cvss: 7.5
epss: 0.00309
exploited: false
status: "open"
category: "runtime"
products: [{"name": "stdlib", "fixed": ["1.26.9", "1.27.2"], "affected": ">= 1.27.0-0, < 1.27.2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "httputil.reverseproxy", "reverse-proxy", "runtime", "shared-transport"]
not_affected_if: ["default-config", "http2-only", "no-connect-forwarding"]
published_at: "2026-10-08T22:31:09+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:56:07+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6605", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-56866", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56866", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# HTTP/1 client connection desynchronization after CONNECT rejection in net/http

Go's net/http HTTP/1 client can leave a pooled connection desynchronized after a CONNECT request with a body is rejected by the server, because the body bytes are sent unframed and may be read by the server as a second request. An attacker who can influence requests through a shared client or reverse proxy can get the next caller to receive a response meant for someone else.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:stdlib affected >= 1.27.0-0, < 1.27.2 fixed 1.26.9, 1.27.2

## How to check

Check whether the Go toolchain or module that builds the service is at go1.26.9 or go1.27.2 or later, or run `go version` on the build host.
Find services that forward CONNECT through a shared http.Transport, such as httputil.ReverseProxy with CONNECT support.

## Fix

Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6605
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-56866
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56866

## From the sources

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_