{"id":"CVE-2026-94439","kind":"vulnerability","aliases":["CVE-2026-94439","GO-2026-6613"],"related":[],"title":"HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.\n\nThe impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.","summary":"Go's net/http HTTP/1 server keeps reading requests from a connection after a handler sent a 2xx response to a CONNECT request without hijacking it, when that connection should have become a tunnel. An attacker behind an intermediate proxy can smuggle requests past the proxy, which treats the connection as a tunnel while the Go server still parses it as HTTP.","severity":"high","cvss":7.5,"epss":0.00315,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.9","1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","net/http","package","reverse-proxy","self-hosted"],"not_affected_if":["go-below-1.27.0-or-patched","managed-hosting","no-connect-handlers"],"how_to_check":"Run `go version` on the build host and on the server binaries; versions 1.27.0 up to but not including 1.27.2 are affected, and 1.26.x is fixed at 1.26.9.\nFind handlers that answer CONNECT requests with a 2xx status: grep the codebase for `http.MethodConnect` or `CONNECT`.","fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild the server binaries.\nIf your handler answers CONNECT, hijack the connection instead of returning, or stop returning 2xx for CONNECT.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:04+00:00","updated_at":"2026-10-23T19:56:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:56:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild the server binaries.\nIf your handler answers CONNECT, hijack the connection instead of returning, or stop returning 2xx for CONNECT.","summary":"Go's net/http HTTP/1 server keeps reading requests from a connection after a handler sent a 2xx response to a CONNECT request without hijacking it, when that connection should have become a tunnel. An attacker behind an intermediate proxy can smuggle requests past the proxy, which treats the connection as a tunnel while the Go server still parses it as HTTP.","category":"package","who_cares":["go","net/http","self-hosted","reverse-proxy"],"confidence":0.7,"analyst_note":"","how_to_check":"Run `go version` on the build host and on the server binaries; versions 1.27.0 up to but not including 1.27.2 are affected, and 1.26.x is fixed at 1.26.9.\nFind handlers that answer CONNECT requests with a 2xx status: grep the codebase for `http.MethodConnect` or `CONNECT`.\nunknown for whether a proxy in front of the service treats CONNECT tunnels specially.","needs_analyst":false,"not_affected_if":["no-connect-handlers","go-below-1.27.0-or-patched","managed-hosting"],"severity_if_unknown":"unknown"},"cost_usd":0.000462,"input_tokens":2209,"output_tokens":482,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,18A '-6613':16A '-94439':13A,19A '2xx':6A,46B,98C,125C 'attack':64B 'becom':60B 'behind':65B 'connect':3A,7A,40B,50B,57B,78B,103C,110C,122C,130C,133C,143C,170C 'consid':165C,177C 'contain':147C 'continu':114C,145C 'convert':131C 'cve':11A,17A 'data':167C 'desynchron':4A 'go':14A,21B,30B,84B 'handler':43B,95C 'hijack':53B,108C 'host':29B 'http':90B,93C,148C,181C 'http/1':1A,33B,102C,129C 'impact':150C 'improp':113C 'intermedi':67B,163C 'keep':35B 'limit':156C 'misbehavior':153C 'most':155C 'net/http':10A,22B,32B 'packag':23B 'pars':87B 'past':72B 'potenti':158C 'proxi':26B,68B,74B,164C 'read':36B,116C 'request':37B,51B,71B,104C,119C,159C 'respons':8A,47B,99C,126C 'return':106C 'revers':25B 'reverse-proxi':24B 'self':28B 'self-host':27B 'send':96C 'sent':44B 'serv':118C 'server':2A,34B,85B,94C,112C,138C,176C 'sinc':123C 'smuggl':70B,160C 'stdlib':20A 'still':86B 'treat':76B,141C 'tunnel':62B,81B,136C,173C 'without':52B,107C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6613","url":"https://pkg.go.dev/vuln/GO-2026-6613","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94439","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94439","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-94439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439","severity":null,"published_at":"2026-10-08T23:17:04+00:00","modified_at":"2026-10-09T17:16:50+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}