CVE-2026-94439High· 7.5▾ TwilightWhen an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
— → 7.5
none → high
0.2% → 0.4%
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
stdlib >= 1.27.0-0, < 1.27.2Patched in:
stdlib 1.27.2Source: https://osv.dev/vulnerability/GO-2026-6613
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-78660High· 7.5Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing
CVE-2026-56866High· 7.5When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers
CVE-2026-97032High· 7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
CVE-2026-97031High· 7.5Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references
CVE-2026-97030Medium· 6.1A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped
CVE-2026-94448Medium· 6.1When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression