CVE-2026-94439

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-09

Assigner: Go Project

Description

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94439

EUVD

EUVD-2026-95428

Affected Vendors & Products

Vendor	Product	Version / Range
Go	standard	library net/http 0
Go	standard	library net/http 1.27.0-0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability involves an HTTP server misbehaving when handling HTTP/1 CONNECT requests. If the server sends a 2xx response to such a request but does not hijack the connection, it incorrectly continues to read and serve subsequent requests as if they were normal HTTP traffic. This is problematic because a 2xx response to a CONNECT request should convert the connection into a tunnel, meaning no further HTTP requests should be processed on that connection.

Detection Guidance

This vulnerability involves improper handling of HTTP/1 CONNECT requests by Go's net/http server. Detection requires checking if your Go application uses the net/http package and if it improperly processes responses to CONNECT requests without hijacking the connection. Review server logs for 2xx responses to CONNECT requests and monitor for potential request smuggling behavior.

Impact Analysis

The primary impact is potential request smuggling. An attacker could exploit this to send malicious requests through the connection, which an intermediate proxy might treat as tunneled data while the server processes it as HTTP. This could lead to unauthorized access, data breaches, or other security issues depending on the server's configuration and the attacker's goals.

Compliance Impact

This vulnerability primarily enables request smuggling, which could allow unauthorized data access or manipulation. For GDPR, this may risk unauthorized data processing or breaches. For HIPAA, it could expose protected health information if request smuggling leads to data interception or tampering.

Mitigation Strategies

Update to the latest version of Go where this issue is fixed. Avoid using HTTP/1 CONNECT requests in your server handlers unless explicitly required for tunneling.

Hi! I’m here to help you understand CVE-2026-94439. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70