HTTP/1 client connection desynchronization after CONNECT rejection in net/http

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-56866 · Microsoft / collected KEV context

EUVD-2026-95421

GHSA-f5vf-8pvc-394g

GO-2026-6605

BIT-golang-2026-56866

cve-program · CVE-2026-56866

• https://go.dev/cl/847306
• https://go.dev/issue/81740
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://pkg.go.dev/vuln/GO-2026-6605

euvd · EUVD-2026-95421

• https://go.dev/cl/847306
• https://go.dev/issue/81740
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://pkg.go.dev/vuln/GO-2026-6605

nvd · CVE-2026-56866

• https://go.dev/cl/847306
• https://go.dev/issue/81740
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://pkg.go.dev/vuln/GO-2026-6605

osv · GO-2026-6605

• https://go.dev/cl/847306
• https://go.dev/issue/81740
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

• When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive … · Advisory content revised · 1 Nov 2026