Live › vulnerability › CVE-2026-94439
Go to dashboardGo's net/http HTTP/1 server keeps reading requests from a connection after a handler sent a 2xx response to a CONNECT request without hijacking it, when that connection should have become a tunnel. An attacker behind an intermediate proxy can smuggle requests past the proxy, which treats the connection as a tunnel while the Go server still parses it as HTTP.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| stdlib | go | >= 1.27.0-0, < 1.27.2 | 1.26.9, 1.27.2 |
Run go version on the build host and on the server binaries; versions 1.27.0 up to but not including 1.27.2 are affected, and 1.26.x is fixed at 1.26.9.
Find handlers that answer CONNECT requests with a 2xx status: grep the codebase for http.MethodConnect or CONNECT.
1.26.9 or and rebuild the server binaries1.27.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.
The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
This page as .md · .json · in your agent: get_signal("CVE-2026-94439")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.