---
id: "CVE-2026-94439"
kind: "vulnerability"
aliases: ["CVE-2026-94439", "GO-2026-6613"]
title: "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http"
severity: "high"
cvss: 7.5
epss: 0.00315
exploited: false
status: "open"
category: "package"
products: [{"name": "stdlib", "fixed": ["1.26.9", "1.27.2"], "affected": ">= 1.27.0-0, < 1.27.2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "net/http", "package", "reverse-proxy", "self-hosted"]
not_affected_if: ["go-below-1.27.0-or-patched", "managed-hosting", "no-connect-handlers"]
published_at: "2026-10-08T22:31:09+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:56:04+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6613", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94439", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94439", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

Go's net/http HTTP/1 server keeps reading requests from a connection after a handler sent a 2xx response to a CONNECT request without hijacking it, when that connection should have become a tunnel. An attacker behind an intermediate proxy can smuggle requests past the proxy, which treats the connection as a tunnel while the Go server still parses it as HTTP.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:stdlib affected >= 1.27.0-0, < 1.27.2 fixed 1.26.9, 1.27.2

## How to check

Run `go version` on the build host and on the server binaries; versions 1.27.0 up to but not including 1.27.2 are affected, and 1.26.x is fixed at 1.26.9.
Find handlers that answer CONNECT requests with a 2xx status: grep the codebase for `http.MethodConnect` or `CONNECT`.

## Fix

Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild the server binaries.
If your handler answers CONNECT, hijack the connection instead of returning, or stop returning 2xx for CONNECT.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6613
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-94439
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94439

## From the sources

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.

The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_