{"id":"CVE-2026-94439","revision":"03097bcd985b460186bfb05c5ebf10c0","records":[{"revision":"03097bcd985b460186bfb05c5ebf10c0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-94439","aliases":[],"title":"HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.","state":0,"publishedAt":"2026-10-08T22:53:59.976+00:00","modifiedAt":"2026-10-09T16:52:15.154+00:00","affected":[{"ecosystem":"https://pkg.go.dev","name":"net/http","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Go standard library\",\n                    \"product\": \"net/http\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"net/http\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.26.9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"1.27.0-0\",\n                            \"lessThan\": \"1.27.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"chunkWriter.writeHeader\"\n                        },\n                        {\n                            \"name\": \"CanonicalHeaderKey\"\n                        },\n                        {\n                            \"name\": \"Client.CloseIdleConnections\"\n                        },\n                        {\n                            \"name\": \"Client.Do\"\n                        },\n                        {\n                            \"name\": \"Client.Get\"\n                        },\n                        {\n                            \"name\": \"Client.Head\"\n                        },\n                        {\n                            \"name\": \"Client.Post\"\n                        },\n                        {\n                            \"name\": \"Client.PostForm\"\n                        },\n                        {\n                            \"name\": \"ClientConn.Close\"\n                        },\n                        {\n                            \"name\": \"ClientConn.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"Cookie.String\"\n                        },\n                        {\n                            \"name\": \"Cookie.Valid\"\n                        },\n                        {\n                            \"name\": \"CrossOriginProtection.AddInsecureBypassPattern\"\n                        },\n                        {\n                            \"name\": \"CrossOriginProtection.AddTrustedOrigin\"\n                        },\n                        {\n                            \"name\": \"CrossOriginProtection.Check\"\n                        },\n                        {\n                            \"name\": \"Dir.Open\"\n                        },\n                        {\n                            \"name\": \"Error\"\n                        },\n                        {\n                            \"name\": \"Get\"\n                        },\n                        {\n                            \"name\": \"Handle\"\n                        },\n                        {\n                            \"name\": \"HandleFunc\"\n                        },\n                        {\n                            \"name\": \"HandlerFunc.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"Head\"\n                        },\n                        {\n                            \"name\": \"Header.Add\"\n                        },\n                        {\n                            \"name\": \"Header.Del\"\n                        },\n                        {\n                            \"name\": \"Header.Get\"\n                        },\n                        {\n                            \"name\": \"Header.Set\"\n                        },\n                        {\n                            \"name\": \"Header.Values\"\n                        },\n                        {\n                            \"name\": \"Header.Write\"\n                        },\n                        {\n                            \"name\": \"Header.WriteSubset\"\n                        },\n                        {\n                            \"name\": \"ListenAndServe\"\n                        },\n                        {\n                            \"name\": \"ListenAndServeTLS\"\n                        },\n                        {\n                            \"name\": \"NewRequest\"\n                        },\n                        {\n                            \"name\": \"NewRequestWithContext\"\n                        },\n                        {\n                            \"name\": \"NotFound\"\n                        },\n                        {\n                            \"name\": \"ParseCookie\"\n                        },\n                        {\n                            \"name\": \"ParseSetCookie\"\n                        },\n                        {\n                            \"name\": \"ParseTime\"\n                        },\n                        {\n                            \"name\": \"Post\"\n                        },\n                        {\n                            \"name\": \"PostForm\"\n                        },\n                        {\n                            \"name\": \"ProxyFromEnvironment\"\n                        },\n                        {\n                            \"name\": \"ReadRequest\"\n                        },\n                        {\n                            \"name\": \"ReadResponse\"\n                        },\n                        {\n                            \"name\": \"Redirect\"\n                        },\n                        {\n                            \"name\": \"Request.AddCookie\"\n                        },\n                        {\n                            \"name\": \"Request.BasicAuth\"\n                        },\n                        {\n                            \"name\": \"Request.Cookie\"\n                        },\n                        {\n                            \"name\": \"Request.Cookies\"\n                        },\n                        {\n                            \"name\": \"Request.CookiesNamed\"\n                        },\n                        {\n                            \"name\": \"Request.FormFile\"\n                        },\n                        {\n                            \"name\": \"Request.FormValue\"\n                        },\n                        {\n                            \"name\": \"Request.MultipartReader\"\n                        },\n                        {\n                            \"name\": \"Request.ParseForm\"\n                        },\n                        {\n                            \"name\": \"Request.ParseMultipartForm\"\n                        },\n                        {\n                            \"name\": \"Request.PostFormValue\"\n                        },\n                        {\n                            \"name\": \"Request.Referer\"\n                        },\n                        {\n                            \"name\": \"Request.SetBasicAuth\"\n                        },\n                        {\n                            \"name\": \"Request.UserAgent\"\n                        },\n                        {\n                            \"name\": \"Request.Write\"\n                        },\n                        {\n                            \"name\": \"Request.WriteProxy\"\n                        },\n                        {\n                            \"name\": \"Response.Cookies\"\n                        },\n                        {\n                            \"name\": \"Response.Location\"\n                        },\n                        {\n                            \"name\": \"Response.Write\"\n                        },\n                        {\n                            \"name\": \"ResponseController.EnableFullDuplex\"\n                        },\n                        {\n                            \"name\": \"ResponseController.Flush\"\n                        },\n                        {\n                            \"name\": \"ResponseController.Hijack\"\n                        },\n                        {\n                            \"name\": \"ResponseController.SetReadDeadline\"\n                        },\n                        {\n                            \"name\": \"ResponseController.SetWriteDeadline\"\n                        },\n                        {\n                            \"name\": \"Serve\"\n                        },\n                        {\n                            \"name\": \"ServeContent\"\n                        },\n                        {\n                            \"name\": \"ServeFile\"\n                        },\n                        {\n                            \"name\": \"ServeFileFS\"\n                        },\n                        {\n                            \"name\": \"ServeMux.Handle\"\n                        },\n                        {\n                            \"name\": \"ServeMux.HandleFunc\"\n                        },\n                        {\n                            \"name\": \"ServeMux.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"ServeTLS\"\n                        },\n                        {\n                            \"name\": \"Server.Close\"\n                        },\n                        {\n                            \"name\": \"Server.ListenAndServe\"\n                        },\n                        {\n                            \"name\": \"Server.ListenAndServeTLS\"\n                        },\n                        {\n                            \"name\": \"Server.Serve\"\n                        },\n                        {\n                            \"name\": \"Server.ServeTLS\"\n                        },\n                        {\n                            \"name\": \"Server.SetKeepAlivesEnabled\"\n                        },\n                        {\n                            \"name\": \"Server.Shutdown\"\n                        },\n                        {\n                            \"name\": \"SetCookie\"\n                        },\n                        {\n                            \"name\": \"Transport.CancelRequest\"\n                        },\n                        {\n                            \"name\": \"Transport.Clone\"\n                        },\n                        {\n                            \"name\": \"Transport.CloseIdleConnections\"\n                        },\n                        {\n                            \"name\": \"Transport.NewClientConn\"\n                        },\n                        {\n                            \"name\": \"Transport.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"body.Close\"\n                        },\n                        {\n                            \"name\": \"body.Read\"\n                        },\n                        {\n                            \"name\": \"bodyEOFSignal.Close\"\n                        },\n                        {\n                            \"name\": \"bodyEOFSignal.Read\"\n                        },\n                        {\n                            \"name\": \"bodyLocked.Read\"\n                        },\n                        {\n                            \"name\": \"bufioFlushWriter.Write\"\n                        },\n                        {\n                            \"name\": \"cancelTimerBody.Close\"\n                        },\n                        {\n                            \"name\": \"cancelTimerBody.Read\"\n                        },\n                        {\n                            \"name\": \"checkConnErrorWriter.Write\"\n                        },\n                        {\n                            \"name\": \"chunkWriter.Write\"\n                        },\n                        {\n                            \"name\": \"connReader.Read\"\n                        },\n                        {\n                            \"name\": \"connectMethodKey.String\"\n                        },\n                        {\n                            \"name\": \"expectContinueReader.Close\"\n                        },\n                        {\n                            \"name\": \"expectContinueReader.Read\"\n                        },\n                        {\n                            \"name\": \"extraHeader.Write\"\n                        },\n                        {\n                            \"name\": \"fileHandler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"fileTransport.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"globalOptionsHandler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"gzipReader.Close\"\n                        },\n                        {\n                            \"name\": \"gzipReader.Read\"\n                        },\n                        {\n                            \"name\": \"http1ClientConn.Close\"\n                        },\n                        {\n                            \"name\": \"http1ClientConn.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"http2ClientConn.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"http2Handler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"http2ResponseWriter.Flush\"\n                        },\n                        {\n                            \"name\": \"http2ResponseWriter.FlushError\"\n                        },\n                        {\n                            \"name\": \"http2ResponseWriter.Push\"\n                        },\n                        {\n                            \"name\": \"http2RoundTripper.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"http3ServerHandler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"initALPNRequest.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"loggingConn.Close\"\n                        },\n                        {\n                            \"name\": \"loggingConn.Read\"\n                        },\n                        {\n                            \"name\": \"loggingConn.Write\"\n                        },\n                        {\n                            \"name\": \"maxBytesReader.Close\"\n                        },\n                        {\n                            \"name\": \"maxBytesReader.Read\"\n                        },\n                        {\n                            \"name\": \"onceCloseListener.Close\"\n                        },\n                        {\n                            \"name\": \"persistConn.Read\"\n                        },\n                        {\n                            \"name\": \"persistConnWriter.ReadFrom\"\n                        },\n                        {\n                            \"name\": \"persistConnWriter.Write\"\n                        },\n                        {\n                            \"name\": \"populateResponse.Write\"\n                        },\n                        {\n                            \"name\": \"populateResponse.WriteHeader\"\n                        },\n                        {\n                            \"name\": \"readTrackingBody.Close\"\n                        },\n                        {\n                            \"name\": \"readTrackingBody.Read\"\n                        },\n                        {\n                            \"name\": \"readWriteCloserBody.CloseWrite\"\n                        },\n                        {\n                            \"name\": \"readWriteCloserBody.Read\"\n                        },\n                        {\n                            \"name\": \"redirectHandler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"response.Flush\"\n                        },\n                        {\n                            \"name\": \"response.FlushError\"\n                        },\n                        {\n                            \"name\": \"response.Hijack\"\n                        },\n                        {\n                            \"name\": \"response.ReadFrom\"\n                        },\n                        {\n                            \"name\": \"response.Write\"\n                        },\n                        {\n                            \"name\": \"response.WriteHeader\"\n                        },\n                        {\n                            \"name\": \"response.WriteString\"\n                        },\n                        {\n                            \"name\": \"serverHandler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"socksDialer.DialWithConn\"\n                        },\n                        {\n                            \"name\": \"socksUsernamePassword.Authenticate\"\n                        },\n                        {\n                            \"name\": \"stringWriter.WriteString\"\n                        },\n                        {\n                            \"name\": \"timeoutHandler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"timeoutWriter.Write\"\n                        },\n                        {\n                            \"name\": \"timeoutWriter.WriteHeader\"\n                        },\n                        {\n                            \"name\": \"transportReadFromServerError.Error\"\n                        },\n                        {\n                            \"name\": \"unencryptedHTTP2Request.ServeHTTP\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://go.dev/cl/847311","https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6613"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-94439","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-94439","identifiers":["CVE-2026-94439"]},"retained":false,"historicalAffected":[]}],"coverage":[]}