{"id":"CVE-2026-94439","sourceIdentifier":"security@golang.org","published":"2026-10-08T23:17:04.760","lastModified":"2026-10-09T17:16:50.703","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."}],"affected":[{"source":"security@golang.org","affectedData":[{"vendor":"Go standard library","product":"net/http","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"net/http","programRoutines":[{"name":"chunkWriter.writeHeader"},{"name":"CanonicalHeaderKey"},{"name":"Client.CloseIdleConnections"},{"name":"Client.Do"},{"name":"Client.Get"},{"name":"Client.Head"},{"name":"Client.Post"},{"name":"Client.PostForm"},{"name":"ClientConn.Close"},{"name":"ClientConn.RoundTrip"},{"name":"Cookie.String"},{"name":"Cookie.Valid"},{"name":"CrossOriginProtection.AddInsecureBypassPattern"},{"name":"CrossOriginProtection.AddTrustedOrigin"},{"name":"CrossOriginProtection.Check"},{"name":"Dir.Open"},{"name":"Error"},{"name":"Get"},{"name":"Handle"},{"name":"HandleFunc"},{"name":"HandlerFunc.ServeHTTP"},{"name":"Head"},{"name":"Header.Add"},{"name":"Header.Del"},{"name":"Header.Get"},{"name":"Header.Set"},{"name":"Header.Values"},{"name":"Header.Write"},{"name":"Header.WriteSubset"},{"name":"ListenAndServe"},{"name":"ListenAndServeTLS"},{"name":"NewRequest"},{"name":"NewRequestWithContext"},{"name":"NotFound"},{"name":"ParseCookie"},{"name":"ParseSetCookie"},{"name":"ParseTime"},{"name":"Post"},{"name":"PostForm"},{"name":"ProxyFromEnvironment"},{"name":"ReadRequest"},{"name":"ReadResponse"},{"name":"Redirect"},{"name":"Request.AddCookie"},{"name":"Request.BasicAuth"},{"name":"Request.Cookie"},{"name":"Request.Cookies"},{"name":"Request.CookiesNamed"},{"name":"Request.FormFile"},{"name":"Request.FormValue"},{"name":"Request.MultipartReader"},{"name":"Request.ParseForm"},{"name":"Request.ParseMultipartForm"},{"name":"Request.PostFormValue"},{"name":"Request.Referer"},{"name":"Request.SetBasicAuth"},{"name":"Request.UserAgent"},{"name":"Request.Write"},{"name":"Request.WriteProxy"},{"name":"Response.Cookies"},{"name":"Response.Location"},{"name":"Response.Write"},{"name":"ResponseController.EnableFullDuplex"},{"name":"ResponseController.Flush"},{"name":"ResponseController.Hijack"},{"name":"ResponseController.SetReadDeadline"},{"name":"ResponseController.SetWriteDeadline"},{"name":"Serve"},{"name":"ServeContent"},{"name":"ServeFile"},{"name":"ServeFileFS"},{"name":"ServeMux.Handle"},{"name":"ServeMux.HandleFunc"},{"name":"ServeMux.ServeHTTP"},{"name":"ServeTLS"},{"name":"Server.Close"},{"name":"Server.ListenAndServe"},{"name":"Server.ListenAndServeTLS"},{"name":"Server.Serve"},{"name":"Server.ServeTLS"},{"name":"Server.SetKeepAlivesEnabled"},{"name":"Server.Shutdown"},{"name":"SetCookie"},{"name":"Transport.CancelRequest"},{"name":"Transport.Clone"},{"name":"Transport.CloseIdleConnections"},{"name":"Transport.NewClientConn"},{"name":"Transport.RoundTrip"},{"name":"body.Close"},{"name":"body.Read"},{"name":"bodyEOFSignal.Close"},{"name":"bodyEOFSignal.Read"},{"name":"bodyLocked.Read"},{"name":"bufioFlushWriter.Write"},{"name":"cancelTimerBody.Close"},{"name":"cancelTimerBody.Read"},{"name":"checkConnErrorWriter.Write"},{"name":"chunkWriter.Write"},{"name":"connReader.Read"},{"name":"connectMethodKey.String"},{"name":"expectContinueReader.Close"},{"name":"expectContinueReader.Read"},{"name":"extraHeader.Write"},{"name":"fileHandler.ServeHTTP"},{"name":"fileTransport.RoundTrip"},{"name":"globalOptionsHandler.ServeHTTP"},{"name":"gzipReader.Close"},{"name":"gzipReader.Read"},{"name":"http1ClientConn.Close"},{"name":"http1ClientConn.RoundTrip"},{"name":"http2ClientConn.RoundTrip"},{"name":"http2Handler.ServeHTTP"},{"name":"http2ResponseWriter.Flush"},{"name":"http2ResponseWriter.FlushError"},{"name":"http2ResponseWriter.Push"},{"name":"http2RoundTripper.RoundTrip"},{"name":"http3ServerHandler.ServeHTTP"},{"name":"initALPNRequest.ServeHTTP"},{"name":"loggingConn.Close"},{"name":"loggingConn.Read"},{"name":"loggingConn.Write"},{"name":"maxBytesReader.Close"},{"name":"maxBytesReader.Read"},{"name":"onceCloseListener.Close"},{"name":"persistConn.Read"},{"name":"persistConnWriter.ReadFrom"},{"name":"persistConnWriter.Write"},{"name":"populateResponse.Write"},{"name":"populateResponse.WriteHeader"},{"name":"readTrackingBody.Close"},{"name":"readTrackingBody.Read"},{"name":"readWriteCloserBody.CloseWrite"},{"name":"readWriteCloserBody.Read"},{"name":"redirectHandler.ServeHTTP"},{"name":"response.Flush"},{"name":"response.FlushError"},{"name":"response.Hijack"},{"name":"response.ReadFrom"},{"name":"response.Write"},{"name":"response.WriteHeader"},{"name":"response.WriteString"},{"name":"serverHandler.ServeHTTP"},{"name":"socksDialer.DialWithConn"},{"name":"socksUsernamePassword.Authenticate"},{"name":"stringWriter.WriteString"},{"name":"timeoutHandler.ServeHTTP"},{"name":"timeoutWriter.Write"},{"name":"timeoutWriter.WriteHeader"},{"name":"transportReadFromServerError.Error"},{"name":"unencryptedHTTP2Request.ServeHTTP"}],"versions":[{"version":"0","lessThan":"1.26.9","versionType":"semver","status":"affected"},{"version":"1.27.0-0","lessThan":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T16:45:53.919403Z","id":"CVE-2026-94439","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-444"}]}],"references":[{"url":"https://go.dev/cl/847311","source":"security@golang.org"},{"url":"https://go.dev/issue/81744","source":"security@golang.org"},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","source":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2026-6613","source":"security@golang.org"}]}