CVE-2026-56866

Received Received - Intake

HTTP/1 CONNECT Request Body Injection in Go

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Go Project

Description

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-56866

EUVD

EUVD-2026-95421

Affected Vendors & Products

Vendor	Product	Version / Range
Go	standard	library net/http 0
Go	standard	library net/http 1.27.0-0
Go	standard	library net/http/httputil 0
Go	standard	library net/http/httputil 1.27.0-0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability occurs when the Go http.Transport sends an HTTP/1 CONNECT request with a non-empty request body. The body is written directly to the connection without proper framing after headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, the connection is returned to the idle pool. The server may then interpret the trailing body bytes as a new pipelined HTTP/1.1 request, causing the connection to become desynchronized. This can lead to cross-user response poisoning in reverse proxies that share the Transport.

Detection Guidance

This vulnerability affects Go's net/http and net/http/httputil packages when handling HTTP/1 CONNECT requests with non-empty request bodies. Detection requires checking if your Go applications use these packages in reverse proxy configurations. Inspect Go application dependencies and proxy configurations for potential exposure.

Impact Analysis

If you use Go's http.Transport or reverse proxies like httputil.ReverseProxy to forward CONNECT requests, this vulnerability could allow an attacker to inject requests and receive responses intended for other users. This may result in unauthorized access to sensitive data or actions performed on behalf of other users.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Go components may face compliance violations, legal penalties, and reputational damage due to potential exposure of personal or health data.

Mitigation Strategies

Update Go to the latest version to ensure the http.Transport vulnerability is patched. Avoid using http.Transport directly for CONNECT requests in reverse proxies. Monitor network traffic for unexpected pipelined requests or desynchronized connections.

Hi! I’m here to help you understand CVE-2026-56866. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70