GO-2026-6605

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6605

Import Source

https://vuln.go.dev/ID/GO-2026-6605.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6605

Aliases

CVE-2026-56866

Published

2026-10-08T22:31:09Z

Modified

2026-10-08T23:00:13Z

Summary

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

Details

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6605"
}

References

Credits

- Xclow3n (Rajat Raghav)

Affected packages

Go / stdlib

Package

Name: stdlib; View open source insights on deps.dev
Purl: pkg:golang/stdlib

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.9

Introduced

1.27.0-0

Fixed

1.27.2

Ecosystem specific

{
    "imports": [
        {
            "path": "net/http",
            "symbols": [
                "Client.CloseIdleConnections",
                "Client.Do",
                "Client.Get",
                "Client.Head",
                "Client.Post",
                "Client.PostForm",
                "ClientConn.Close",
                "ClientConn.RoundTrip",
                "Get",
                "Head",
                "Post",
                "PostForm",
                "Transport.CloseIdleConnections",
                "Transport.NewClientConn",
                "Transport.RoundTrip",
                "http1ClientConn.Close",
                "http1ClientConn.RoundTrip",
                "persistConn.readLoop"
            ]
        },
        {
            "path": "net/http/httputil",
            "symbols": [
                "DumpRequestOut",
                "ReverseProxy.ServeHTTP"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6605.json"