Connection desynchronization after CONNECT response in Go net/http
Priority LOW 39CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 18 fixed, 88 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
Go net/http versions before 1.26.9 and from 1.27.0-0 before 1.27.2 are affected. After a handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server keeps parsing the connection as HTTP instead of a tunnel (CWE-444). A remote attacker without privileges or user interaction can use this for request smuggling, where an intermediate proxy treats the connection as tunneled while the server reads it as HTTP.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00528 44th percentileScored 2026-11-07
Fix Partial net/http (Go standard library): 1.26.9, 1.27.2Red Hat: 15 advisoriesRed Hat: 18 fixed, 88 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | net/http | before 1.26.9; 1.27.0-0 to before 1.27.2 | 1.26.9, 1.27.2 | Patch available | CNA |
- net/http VendorGo standard library Affected before 1.26.9; 1.27.0-0 to before 1.27.2 Fixed in 1.26.9, 1.27.2 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | — | — | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions — — ·Go standard library
Remediation
Upgrade Go to version 1.26.9 or 1.27.2. Red Hat fixes it in advisories including RHSA-2026:86093, RHSA-2026:86196 and RHSA-2026:86203. Red Hat lists AWS Load Balancer Operator, Ansible Automation Orchestrator 2026, Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Compliance Operator and other products as affected without a fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA net/http (Go standard library) Fixed in 1.26.9, 1.27.2
Red Hat 15 advisories
- RHSA-2026:92516 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.4.4
- Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
- RHSA-2026:92509 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.3.9
- Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
- RHSA-2026:92497 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.2.11
- Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
Show 12 more Red Hat advisories
- RHSA-2026:92480 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.1.14
- Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
- RHSA-2026:92451 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.0.17
- Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
- RHSA-2026:90994 Released 2026-10-27 · Red Hat rating Importantgo-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
- RHSA-2026:87245 Released 2026-10-21 · Red Hat rating Importantgo-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8 +13
- Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.8.0+25113+a148ecc0.x86_64::go-toolset:rhel8 +8
- RHSA-2026:87246 Released 2026-10-21 · Red Hat rating Importantgo-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
- RHSA-2026:87043 Released 2026-10-21 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) go-toolset-1.26.10-1.el9_6, golang-1.26.10-1.el9_6, golang-bin-1.26.10-1.el9_6 +5
- RHSA-2026:87042 Released 2026-10-21 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) go-toolset-1.26.10-1.el9_4, golang-1.26.10-1.el9_4, golang-bin-1.26.10-1.el9_4 +5
- RHSA-2026:87041 Released 2026-10-21 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) go-toolset-1.26.10-1.el9_2, golang-1.26.10-1.el9_2, golang-bin-1.26.10-1.el9_2 +5
- RHSA-2026:87040 Released 2026-10-21 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) go-toolset-1.26.10-1.el10_0, golang-1.26.10-1.el10_0, golang-bin-1.26.10-1.el10_0 +5
- RHSA-2026:86196 Released 2026-10-20 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.26.10-1.el9_8, golang-1.26.10-1.el9_8, golang-bin-1.26.10-1.el9_8 +5
- RHSA-2026:86203 Released 2026-10-20 · Red Hat rating Importantgo-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.26.1-1.module+el8.10.0+24516+40554724.aarch64::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.src::go-toolset:rhel8 +22
- RHSA-2026:86093 Released 2026-10-20 · Red Hat rating Importantgolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.26.10-1.el10_2, golang-1.26.10-1.el10_2, golang-bin-1.26.10-1.el10_2 +5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Go standard library net/http 1.26.9, 1.27.2
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-69827 Excessive CPU use in Go net/http when parsing Range headersPriority MEDIUM 40
- TI-2026-69821 Connection desynchronization after rejected CONNECT in Go net/httpPriority MEDIUM 40
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| AWS Load Balancer Operator | Affected | — |
| Ansible Automation Orchestrator 2026 | Affected | — |
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | — |
| Builds for Red Hat OpenShift | Affected | — |
| Compliance Operator | Affected | — |
| Confidential Compute Attestation | Affected | — |
| Cost Management Metrics Operator | Affected | — |
| Cost Management On Premise | Affected | — |
| Cryostat 4 | Affected | — |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | — |
| DPU kit for NVIDIA | Affected | — |
| Deployment Validation Operator | Affected | — |
| Exploit Intelligence | Affected | — |
| External Secrets Operator for Red Hat OpenShift | Affected | — |
| Fence Agents Remediation Operator | Affected | — |
| File Integrity Operator | Affected | — |
| Gatekeeper 3 | Affected | — |
| Helm CLI for Red Hat OpenShift | Affected | — |
| Logging Subsystem for Red Hat OpenShift | Affected | — |
| Logical Volume Manager Storage | Affected | — |
| Machine Deletion Remediation Operator | Affected | — |
| Migration Toolkit for Applications 8 | Affected | — |
| Migration Toolkit for Containers | Affected | — |
| Multiarch Tuning Operator | Affected | — |
| Multicluster Engine for Kubernetes | Affected | — |
| Multicluster Global Hub | Affected | — |
| Multicluster Global Hub 5 | Affected | — |
| Network Observability Operator | Affected | — |
| Node HealthCheck Operator | Affected | — |
| Node Maintenance Operator | Affected | — |
| Nvidia GPU Driver for RHEL on Openshift | Affected | — |
| OpenShift API for Data Protection | Affected | — |
| OpenShift Developer Tools and Services | Affected | No fix planned: Out of support scope |
| OpenShift Lightspeed | Affected | — |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet |
| OpenShift Source-to-Image (S2I) | Affected | — |
| Red Hat 3scale API Management Platform 2 | Affected | — |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | — |
| Red Hat Advanced Cluster Security 4 | Affected | — |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 5 | Affected | — |
| Red Hat Ceph Storage 6 | Affected | — |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Connectivity Link 1 | Affected | — |
| Red Hat Developer Hub 1 | Affected | — |
| Red Hat Edge Manager 1 | Affected | — |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Lightspeed for Runtimes Operator | Affected | — |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift Cluster Manager CLI | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | — |
| Red Hat OpenShift Dev Workspaces Operator | Affected | — |
| Red Hat OpenShift GitOps | Affected | — |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 5 | Affected | — |
| Red Hat OpenShift distributed tracing 3 | Affected | — |
| Red Hat OpenShift for Windows Containers | Affected | — |
| Red Hat OpenShift on AWS | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | — |
| Red Hat Quay 3 | Affected | — |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Service Interconnect 1 | Affected | No fix planned: Out of support scope |
| Red Hat Service Interconnect 2 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | — |
| Red Hat Web Terminal | Affected | — |
| Secrets Management Console for Red Hat OpenShift | Affected | — |
| Security Profiles Operator | Affected | — |
| Self-service automation portal 2 | Affected | — |
| Service Telemetry Framework 1.5 | Affected | — |
| Zero Trust Workload Identity Manager | Affected | — |
| Zero Trust Workload Identity Manager - Tech Preview | Affected | — |
| cert-manager Operator for Red Hat OpenShift | Affected | — |
| streams for Apache Kafka 2 | Affected | No fix planned: Out of support scope |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:86093 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:86203 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:86196 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:90994 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:87246 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:87245 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:87041 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:87042 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:87040 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:87043 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:90994 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:87246 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:87245 |
| Red Hat OpenShift Service Mesh 3.0 | Fixed | RHSA-2026:92451 |
| Red Hat OpenShift Service Mesh 3.1 | Fixed | RHSA-2026:92480 |
| Red Hat OpenShift Service Mesh 3.2 | Fixed | RHSA-2026:92497 |
| Red Hat OpenShift Service Mesh 3.3 | Fixed | RHSA-2026:92509 |
| Red Hat OpenShift Service Mesh 3.4 | Fixed | RHSA-2026:92516 |
Not affected: 6 products
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Service Mesh 3.0
- Red Hat OpenShift Service Mesh 3.1
- Red Hat OpenShift Service Mesh 3.2
- Red Hat OpenShift Service Mesh 3.3
- Red Hat OpenShift Service Mesh 3.4
Timeline
- 2026-10-09 Threatist record created from CVE-2026-94439
- 2026-10-09 Alias added: GHSA-2gfw-j3c5-j46w
- 2026-10-10 CVSS score added · CISA ADP
- 2026-10-10 Weakness changed · CISA ADP
- 2026-10-10 CISA SSVC decision points changed
- 2026-10-23 Fix available: RHSA-2026:87246 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:86093 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:86196 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:86203 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:87042 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:87040 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:87041 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:87043 · Red Hat
- 2026-10-23 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +6 · Red Hat
- 2026-10-24 Fix available: RHSA-2026:87245 · Red Hat
- 2026-10-24 Fix available: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · Red Hat
- 2026-10-29 Fix available: RHSA-2026:90994 · Red Hat
- 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92451 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92509 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92497 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92480 · Red Hat
- 2026-10-30 Fix available: Red Hat OpenShift Service Mesh 3.0, Red Hat OpenShift Service Mesh 3.1, Red Hat OpenShift Service Mesh 3.2 +1 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92516 · Red Hat
- 2026-10-31 Fix available: Red Hat OpenShift Service Mesh 3.4 · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
More Go standard library vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
- TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
Sources
- CVE-2026-94439 · CVE Program
- CVE-2026-94439 · NVD
- FIRST EPSS
- GHSA-2gfw-j3c5-j46w · GitHub Advisory Database · CC BY 4.0
- CVE-2026-94439 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences