CVE-2026-94439— HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
Quick assessment
Affected
Go standard library net/http
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当 HTTP 服务器处理器向 HTTP/1 CONNECT 请求发送 2xx 响应且未接管（hijack）连接就返回时，服务器会不当继续从该连接读取并处理请求。由于对 HTTP/1 CONNECT 请求的 2xx 响应会将该连接转换为隧道（tunnel），因此服务器不应再将该连接视为包含 HTTP 数据。这种错误行为的影响主要限于潜在的请求走私（request smuggling）问题，其中中间代理将连接上的数据视为已隧穿（tunneled）内容，而服务器却将其当作普通 HTTP 请求来处理。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94439
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
Source: CVE Program / CVE List V5
Vulnerability Description
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Go standard library | net/http | 0 ~ 1.26.9 | - |
|
II. Public POCs for CVE-2026-94439
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94439
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-94439 (1)
Vendor Pages for CVE-2026-94439 (1)
Other References for CVE-2026-94439 (1)
Other References for CVE-2026-94439 (1)
Same Patch Batch · Go standard library · 2026-10-08 · 13 CVEs total
| CVE-2026-94440 | Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart | |
| CVE-2026-94448 | Reset context tracking on consecutive template expressions in html/template | |
| CVE-2026-56857 | Root.Mkdir(All) can follow junctions out of the root on Windows in os | |
| CVE-2026-56866 | HTTP/1 client connection desynchronization after CONNECT rejection in net/http | |
| CVE-2026-78659 | HTTP/2 server memory exhaustion due to Trailer headers in net/http | |
| CVE-2026-78660 | HTTP/2 transport accepts malformed framing-related headers in net/http | |
| CVE-2026-78663 | Double flow control refund on HTTP/2 server streams in net/http | |
| CVE-2026-78667 | Lack of limit on size of parsed Range headers in net/http | |
| CVE-2026-78669 | Excessive CPU consumption from repeated initial window changes in net/http | |
| CVE-2026-97032 | HTTP/2 server crash due to HPACK encoder race in net/http | |
| CVE-2026-97030 | Recognize yield as regexp preceder keyword in html/template | |
| CVE-2026-97031 | Reject malformed ECH outer extension references in crypto/tls |
IV. Related Vulnerabilities
Same product: net/http
-
CVE-2026-78663
Double flow control refund on HTTP/2 server streams in net/h -
CVE-2026-78669
Excessive CPU consumption from repeated initial window chang -
CVE-2026-97032
HTTP/2 server crash due to HPACK encoder race in net/http -
CVE-2026-78660
HTTP/2 transport accepts malformed framing-related headers i -
CVE-2026-78667
Lack of limit on size of parsed Range headers in net/http
Same vendor: Go standard library
-
CVE-2026-97032
HTTP/2 server crash due to HPACK encoder race in net/http -
CVE-2026-78663
Double flow control refund on HTTP/2 server streams in net/h -
CVE-2026-78669
Excessive CPU consumption from repeated initial window chang -
CVE-2026-78667
Lack of limit on size of parsed Range headers in net/http -
CVE-2026-56866
HTTP/1 client connection desynchronization after CONNECT rej
V. Comments for CVE-2026-94439
No comments yet