{"id":"CVE-2026-94439","title":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection","summary":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-444"],"vendor":"stdlib","product":"stdlib","affected":["stdlib >= 1.27.0-0, < 1.27.2"],"patched":["stdlib 1.27.2"],"published":"2026-10-08","updated":"2026-10-09","sourceUpdated":"2026-10-09T17:16:50.703","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439","references":[{"url":"https://go.dev/cl/847311","label":"security@golang.org"},{"url":"https://go.dev/issue/81744","label":"security@golang.org"},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","label":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2026-6613","label":"security@golang.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94439.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-94439"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548335"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94439"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439"},{"url":"https://access.redhat.com/errata/RHSA-2026:87040"},{"url":"https://access.redhat.com/errata/RHSA-2026:86093"},{"url":"https://access.redhat.com/errata/RHSA-2026:86203"},{"url":"https://access.redhat.com/errata/RHSA-2026:87246"},{"url":"https://access.redhat.com/errata/RHSA-2026:87041"},{"url":"https://access.redhat.com/errata/RHSA-2026:87042"},{"url":"https://access.redhat.com/errata/RHSA-2026:87043"},{"url":"https://access.redhat.com/errata/RHSA-2026:86196"},{"url":"https://access.redhat.com/errata/RHSA-2026:87245"}],"tags":["nvd","osv","go","cve.org","csaf","vex","red-hat"],"epss":0.00414,"epssPercentile":0.35564,"aliases":["GO-2026-6613","BIT-golang-2026-94439"],"ecosystem":"go","ingestedAt":"2026-10-09T00:19:50.978Z","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-09T16:45:53.919403Z"},"scores":{"nvd":7.5,"vendor":6.5},"slug":"CVE-2026-94439","body":"## Overview\n\nWhen an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-94439)\n\nAffected packages:\n\n- `stdlib >= 1.27.0-0, < 1.27.2`\n\nPatched in:\n\n- `stdlib 1.27.2`\n\nSource: https://osv.dev/vulnerability/GO-2026-6613\n\n## Vendor advisories\n\n- **RHSA-2026:87040** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87040)\n- **RHSA-2026:86093** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86093)\n- **RHSA-2026:86203** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86203)\n- **RHSA-2026:87246** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87246)\n- **RHSA-2026:87041** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87041)\n- **RHSA-2026:87042** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87042)\n- **RHSA-2026:87043** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87043)\n- **RHSA-2026:86196** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86196)\n- **Red Hat VEX** · Moderate · affected: OpenShift Developer Tools and Services, OpenShift Pipelines, OpenShift Serverless, OpenShift Service Mesh 3, Red Hat Ansible Automation Platform 2, Red Hat Ceph Storage 7, … · no fix planned: OpenShift Developer Tools and Services, Red Hat Ansible Automation Platform 2, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94439.json)\n- **RHSA-2026:87245** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87245)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":218580,"id":"CVE-2026-94439","ts":1791569313102,"field":"cvss","old":null,"new":"7.5"},{"seq":218579,"id":"CVE-2026-94439","ts":1791569313102,"field":"severity","old":"none","new":"high"}]}