Connection desynchronization after rejected CONNECT in Go net/http
Priority MEDIUM 40CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 18 fixed, 88 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
Go net/http and net/http/httputil before 1.26.9, and from 1.27.0-0 before 1.27.2, are affected. The HTTP/1 transport writes a CONNECT request body without framing and returns the connection to the idle pool after a non-2xx rejection (CWE-444). A remote attacker without privileges or user interaction can leave the pooled connection desynchronized, so the next caller reusing it receives the response to the injected request, which can poison responses across users in reverse proxies that forward CONNECT through a shared Transport.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00604 49th percentileScored 2026-11-07
Fix Partial net/http (Go standard library): 1.26.9, 1.27.2net/http/httputil (Go standard library): 1.26.9, 1.27.2Red Hat: 15 advisoriesRed Hat: 18 fixed, 88 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | net/http | before 1.26.9; 1.27.0-0 to before 1.27.2 | 1.26.9, 1.27.2 | Patch available | CNA |
| Go standard library | net/http/httputil | before 1.26.9; 1.27.0-0 to before 1.27.2 | 1.26.9, 1.27.2 | Patch available | CNA |
- net/http VendorGo standard library Affected before 1.26.9; 1.27.0-0 to before 1.27.2 Fixed in 1.26.9, 1.27.2 Patch available CNA
- net/http/httputil VendorGo standard library Affected before 1.26.9; 1.27.0-0 to before 1.27.2 Fixed in 1.26.9, 1.27.2 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | — | — | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions — — ·Go standard library
Remediation
Upgrade to Go 1.26.9 or 1.27.2, which fix net/http and net/http/httputil. Red Hat fixes it in RHSA-2026:86093, RHSA-2026:86196, RHSA-2026:86203, RHSA-2026:87040, RHSA-2026:87245 and other go-toolset and golang advisories, and in RHSA-2026:92451, RHSA-2026:92480, RHSA-2026:92497, RHSA-2026:92509 and RHSA-2026:92516 for OpenShift Service Mesh 3.0.17, 3.1.14, 3.2.11, 3.3.9 and 3.4.4. Red Hat lists AWS Load Balancer Operator, Compliance Operator and other products as affected without a fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA net/http (Go standard library) Fixed in 1.26.9, 1.27.2
- Fix · CNA net/http/httputil (Go standard library) Fixed in 1.26.9, 1.27.2
Red Hat 15 advisories
- RHSA-2026:92516 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.4.4
- Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
- RHSA-2026:92509 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.3.9
- Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
- RHSA-2026:92497 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.2.11
- Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
Show 12 more Red Hat advisories
- RHSA-2026:92480 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.1.14
- Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
- RHSA-2026:92451 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.0.17
- Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
- RHSA-2026:90994 Released 2026-10-27 · Red Hat rating Importantgo-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
- RHSA-2026:87245 Released 2026-10-21 · Red Hat rating Importantgo-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8 +13
- Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.8.0+25113+a148ecc0.x86_64::go-toolset:rhel8 +8
- RHSA-2026:87246 Released 2026-10-21 · Red Hat rating Importantgo-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
- RHSA-2026:87043 Released 2026-10-21 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) go-toolset-1.26.10-1.el9_6, golang-1.26.10-1.el9_6, golang-bin-1.26.10-1.el9_6 +5
- RHSA-2026:87042 Released 2026-10-21 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) go-toolset-1.26.10-1.el9_4, golang-1.26.10-1.el9_4, golang-bin-1.26.10-1.el9_4 +5
- RHSA-2026:87041 Released 2026-10-21 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) go-toolset-1.26.10-1.el9_2, golang-1.26.10-1.el9_2, golang-bin-1.26.10-1.el9_2 +5
- RHSA-2026:87040 Released 2026-10-21 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) go-toolset-1.26.10-1.el10_0, golang-1.26.10-1.el10_0, golang-bin-1.26.10-1.el10_0 +5
- RHSA-2026:86196 Released 2026-10-20 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.26.10-1.el9_8, golang-1.26.10-1.el9_8, golang-bin-1.26.10-1.el9_8 +5
- RHSA-2026:86203 Released 2026-10-20 · Red Hat rating Importantgo-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.26.1-1.module+el8.10.0+24516+40554724.aarch64::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.src::go-toolset:rhel8 +22
- RHSA-2026:86093 Released 2026-10-20 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.26.10-1.el10_2, golang-1.26.10-1.el10_2, golang-bin-1.26.10-1.el10_2 +5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Go standard library net/http 1.26.9, 1.27.2
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-69827 Excessive CPU use in Go net/http when parsing Range headersPriority MEDIUM 40
- TI-2026-69832 Connection desynchronization after CONNECT response in Go net/httpPriority LOW 39
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| AWS Load Balancer Operator | Affected | — |
| Ansible Automation Orchestrator 2026 | Affected | — |
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | — |
| Builds for Red Hat OpenShift | Affected | — |
| Compliance Operator | Affected | — |
| Confidential Compute Attestation | Affected | — |
| Cost Management Metrics Operator | Affected | — |
| Cost Management On Premise | Affected | — |
| Cryostat 4 | Affected | — |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | — |
| DPU kit for NVIDIA | Affected | — |
| Deployment Validation Operator | Affected | — |
| Exploit Intelligence | Affected | — |
| External Secrets Operator for Red Hat OpenShift | Affected | — |
| Fence Agents Remediation Operator | Affected | — |
| File Integrity Operator | Affected | — |
| Gatekeeper 3 | Affected | — |
| Helm CLI for Red Hat OpenShift | Affected | — |
| Logging Subsystem for Red Hat OpenShift | Affected | — |
| Logical Volume Manager Storage | Affected | — |
| Machine Deletion Remediation Operator | Affected | — |
| Migration Toolkit for Applications 8 | Affected | — |
| Migration Toolkit for Containers | Affected | — |
| Multiarch Tuning Operator | Affected | — |
| Multicluster Engine for Kubernetes | Affected | — |
| Multicluster Global Hub | Affected | — |
| Multicluster Global Hub 5 | Affected | — |
| Network Observability Operator | Affected | — |
| Node HealthCheck Operator | Affected | — |
| Node Maintenance Operator | Affected | — |
| Nvidia GPU Driver for RHEL on Openshift | Affected | — |
| OpenShift API for Data Protection | Affected | — |
| OpenShift Developer Tools and Services | Affected | No fix planned: Out of support scope |
| OpenShift Lightspeed | Affected | — |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet |
| OpenShift Source-to-Image (S2I) | Affected | — |
| Red Hat 3scale API Management Platform 2 | Affected | — |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | — |
| Red Hat Advanced Cluster Security 4 | Affected | — |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 5 | Affected | — |
| Red Hat Ceph Storage 6 | Affected | — |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Connectivity Link 1 | Affected | — |
| Red Hat Developer Hub 1 | Affected | — |
| Red Hat Edge Manager 1 | Affected | — |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Lightspeed for Runtimes Operator | Affected | — |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift Cluster Manager CLI | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | — |
| Red Hat OpenShift Dev Workspaces Operator | Affected | — |
| Red Hat OpenShift GitOps | Affected | — |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 5 | Affected | — |
| Red Hat OpenShift distributed tracing 3 | Affected | — |
| Red Hat OpenShift for Windows Containers | Affected | — |
| Red Hat OpenShift on AWS | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | — |
| Red Hat Quay 3 | Affected | — |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Service Interconnect 1 | Affected | No fix planned: Out of support scope |
| Red Hat Service Interconnect 2 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | — |
| Red Hat Web Terminal | Affected | — |
| Secrets Management Console for Red Hat OpenShift | Affected | — |
| Security Profiles Operator | Affected | — |
| Self-service automation portal 2 | Affected | — |
| Service Telemetry Framework 1.5 | Affected | — |
| Zero Trust Workload Identity Manager | Affected | — |
| Zero Trust Workload Identity Manager - Tech Preview | Affected | — |
| cert-manager Operator for Red Hat OpenShift | Affected | — |
| streams for Apache Kafka 2 | Affected | No fix planned: Out of support scope |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:86093 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:86203 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:86196 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:90994 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:87246 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:87245 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:87041 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:87042 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:87040 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:87043 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:90994 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:87246 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:87245 |
| Red Hat OpenShift Service Mesh 3.0 | Fixed | RHSA-2026:92451 |
| Red Hat OpenShift Service Mesh 3.1 | Fixed | RHSA-2026:92480 |
| Red Hat OpenShift Service Mesh 3.2 | Fixed | RHSA-2026:92497 |
| Red Hat OpenShift Service Mesh 3.3 | Fixed | RHSA-2026:92509 |
| Red Hat OpenShift Service Mesh 3.4 | Fixed | RHSA-2026:92516 |
Not affected: 6 products
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Service Mesh 3.0
- Red Hat OpenShift Service Mesh 3.1
- Red Hat OpenShift Service Mesh 3.2
- Red Hat OpenShift Service Mesh 3.3
- Red Hat OpenShift Service Mesh 3.4
Timeline
- 2026-10-09 Threatist record created from CVE-2026-56866
- 2026-10-09 Alias added: GHSA-f5vf-8pvc-394g
- 2026-10-10 CVSS score added · CISA ADP
- 2026-10-10 Weakness changed · CISA ADP
- 2026-10-10 CISA SSVC decision points changed
- 2026-10-23 Fix available: RHSA-2026:87246 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:86093 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:86196 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:86203 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:87042 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:87040 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:87041 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:87043 · Red Hat
- 2026-10-23 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +6 · Red Hat
- 2026-10-24 Fix available: RHSA-2026:87245 · Red Hat
- 2026-10-24 Fix available: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · Red Hat
- 2026-10-29 Fix available: RHSA-2026:90994 · Red Hat
- 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92451 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92509 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92497 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92480 · Red Hat
- 2026-10-30 Fix available: Red Hat OpenShift Service Mesh 3.0, Red Hat OpenShift Service Mesh 3.1, Red Hat OpenShift Service Mesh 3.2 +1 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92516 · Red Hat
- 2026-10-31 Fix available: Red Hat OpenShift Service Mesh 3.4 · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-08 Priority changed: LOW → MEDIUM
References
More Go standard library vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
- TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
Sources
- CVE-2026-56866 · CVE Program
- CVE-2026-56866 · NVD
- FIRST EPSS
- GHSA-f5vf-8pvc-394g · GitHub Advisory Database · CC BY 4.0
- CVE-2026-56866 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences