--- id: CVE-2026-94439 title: >- When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection summary: >- When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N' cwe: - CWE-444 vendor: stdlib product: stdlib affected: - 'stdlib >= 1.27.0-0, < 1.27.2' patched: - stdlib 1.27.2 published: '2026-10-08' updated: '2026-10-09' sourceUpdated: '2026-10-09T17:16:50.703' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94439' references: - url: 'https://go.dev/cl/847311' label: security@golang.org - url: 'https://go.dev/issue/81744' label: security@golang.org - url: 'https://groups.google.com/g/golang-announce/c/U2fTuyDJznI' label: security@golang.org - url: 'https://pkg.go.dev/vuln/GO-2026-6613' label: security@golang.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94439.json - url: 'https://access.redhat.com/security/cve/CVE-2026-94439' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2548335' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-94439' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94439' - url: 'https://access.redhat.com/errata/RHSA-2026:87040' - url: 'https://access.redhat.com/errata/RHSA-2026:86093' - url: 'https://access.redhat.com/errata/RHSA-2026:86203' - url: 'https://access.redhat.com/errata/RHSA-2026:87246' - url: 'https://access.redhat.com/errata/RHSA-2026:87041' - url: 'https://access.redhat.com/errata/RHSA-2026:87042' - url: 'https://access.redhat.com/errata/RHSA-2026:87043' - url: 'https://access.redhat.com/errata/RHSA-2026:86196' - url: 'https://access.redhat.com/errata/RHSA-2026:87245' tags: - nvd - osv - go - cve.org - csaf - vex - red-hat epss: 0.00414 epssPercentile: 0.35564 aliases: - GO-2026-6613 - BIT-golang-2026-94439 ecosystem: go ingestedAt: '2026-10-09T00:19:50.978Z' ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-10-09T16:45:53.919403Z' scores: nvd: 7.5 vendor: 6.5 --- ## Overview When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-94439) Affected packages: - `stdlib >= 1.27.0-0, < 1.27.2` Patched in: - `stdlib 1.27.2` Source: https://osv.dev/vulnerability/GO-2026-6613 ## Vendor advisories - **RHSA-2026:87040** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87040) - **RHSA-2026:86093** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86093) - **RHSA-2026:86203** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86203) - **RHSA-2026:87246** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87246) - **RHSA-2026:87041** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87041) - **RHSA-2026:87042** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87042) - **RHSA-2026:87043** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87043) - **RHSA-2026:86196** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86196) - **Red Hat VEX** · Moderate · affected: OpenShift Developer Tools and Services, OpenShift Pipelines, OpenShift Serverless, OpenShift Service Mesh 3, Red Hat Ansible Automation Platform 2, Red Hat Ceph Storage 7, … · no fix planned: OpenShift Developer Tools and Services, Red Hat Ansible Automation Platform 2, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94439.json) - **RHSA-2026:87245** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87245)