Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Go standard library net/http 1.26.9, 1.27.2 Clear all filters
TI-2026-69832 CVE-2026-94439 · GHSA-2gfw-j3c5-j46w

Connection desynchronization after CONNECT response in Go net/http

Priority LOW 39

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00528 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 CWE-444
TI-2026-69827 CVE-2026-78667 · GHSA-f4xw-m386-m277

Excessive CPU use in Go net/http when parsing Range headers

Priority MEDIUM 40

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 CWE-770
TI-2026-69821 CVE-2026-56866 · GHSA-f5vf-8pvc-394g

Connection desynchronization after rejected CONNECT in Go net/http

Priority MEDIUM 40

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00604 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 CWE-444