CVE-2026-56866
published 2026-10-08CVE-2026-56866: When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.47%
40.7th percentile
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| buildah_project | buildah | — | — |
| confidential-containers | trustee | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | crun | — | — |
| container-tools_rhel8 | oci-seccomp-bpf-hook | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | runc | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| etcd | etcd | — | — |
| git-lfs | git-lfs | — | — |
| go-toolset_rhel8 | golang | — | — |
| go_standard_library | net_http | < 1.26.9 | 1.26.9 |
| go_standard_library | net_http | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| go_standard_library | net_http_httputil | < 1.26.9 | 1.26.9 |
| go_standard_library | net_http_httputil | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| grafana | grafana | — | — |
| helm | helm | — | — |
| inductiveautomation | ignition | — | — |
| jetbrains | toolbox | — | — |
| kata-containers | kata-containers | — | — |
| kubernetes | cri-o | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Go vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 7.5
CVE-2026-56866 [HIGH] Go vulnerabilities
Title: Go vulnerabilities
Summary: Several security issues were fixed in Go.
It was discovered that Go did not enforce a maximum recursion depth when
parsing deeply nested ASN.1 structures. An attacker could possibly use this
issue to cause Go to crash, resulting in a denial of service.
(CVE-2026-33818)
It was discovered that Go incorrectly reset the depth counter when decoding
XML elements. An attacker could possibly use this issue to cause Go to
crash via deeply nested XML input, resulting in a denial of service.
(CVE-2026-56859)
It was discovered that Go incorrectly handled TLS KeyUpdate messages after
the handshake was completed. A remote attacker could possibly use this
issue to cause Go to use excessive resources, leading to a denial of
service. (CVE-2026-56862)
It was discovere
Red Hat
net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections
vendor_redhat·2026-10-08·CVSS 7.5
CVE-2026-56866 [HIGH] CWE-444 net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections
net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections
A flaw was found in Go's net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to cause cross-user response poisoning, potentially exposing sensitive information or serving unintended content to other users.
Package: helm (OpenShift Developer Tools and Services) - Out of support scope
Package: openshift-pipelines-client (OpenShift Pipelines) - Fix deferred
Package: kn-workflow-plugin (OpenShift Serverless) - Fix deferred
Package: openshift-serverless-clients (OpenShift Serve
GHSA
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers.
ghsa_unreviewed·2026-10-09
CVE-2026-56866 When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers.
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.
VulDB
Google Go up to 1.26.8/1.27.1 net/http/httputil request smuggling (EUVD-2026-95421)
vuldb·2026-10-09·CVSS 7.5
CVE-2026-56866 [HIGH] Google Go up to 1.26.8/1.27.1 net/http/httputil request smuggling (EUVD-2026-95421)
A vulnerability was found in Google Go up to 1.26.8/1.27.1. It has been rated as problematic. Impacted is an unknown function of the component net/http/httputil. Performing a manipulation results in http request smuggling.
This vulnerability is known as CVE-2026-56866. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
2026-10-08
Published