CVE-2026-94439
published 2026-10-08CVE-2026-94439: When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.41%
35.5th percentile
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| buildah_project | buildah | — | — |
| confidential-containers | trustee | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | crun | — | — |
| container-tools_rhel8 | oci-seccomp-bpf-hook | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | runc | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| etcd | etcd | — | — |
| git-lfs | git-lfs | — | — |
| go-toolset_rhel8 | golang | — | — |
| go_standard_library | net_http | < 1.26.9 | 1.26.9 |
| go_standard_library | net_http | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| grafana | grafana | — | — |
| helm | helm | — | — |
| inductiveautomation | ignition | — | — |
| jetbrains | toolbox | — | — |
| kata-containers | kata-containers | — | — |
| kubernetes | cri-o | — | — |
| podman_project | podman | — | — |
| redhat | openshift | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Go vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 7.5
CVE-2026-56866 [HIGH] Go vulnerabilities
Title: Go vulnerabilities
Summary: Several security issues were fixed in Go.
It was discovered that Go did not enforce a maximum recursion depth when
parsing deeply nested ASN.1 structures. An attacker could possibly use this
issue to cause Go to crash, resulting in a denial of service.
(CVE-2026-33818)
It was discovered that Go incorrectly reset the depth counter when decoding
XML elements. An attacker could possibly use this issue to cause Go to
crash via deeply nested XML input, resulting in a denial of service.
(CVE-2026-56859)
It was discovered that Go incorrectly handled TLS KeyUpdate messages after
the handshake was completed. A remote attacker could possibly use this
issue to cause Go to use excessive resources, leading to a denial of
service. (CVE-2026-56862)
It was discovere
Red Hat
net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses
vendor_redhat·2026-10-08·CVSS 7.5
CVE-2026-94439 [HIGH] CWE-444 net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses
net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses
A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can exploit this behavior to conduct HTTP request smuggling through intermediate proxy servers, potentially bypassing security controls.
Package: helm (OpenShift Developer Tools and Services) - Out of support scope
Package: openshift-pipelines-client (OpenShift Pipelines) - Fix deferred
Package: kn-workflow-plugin (OpenShift Serverless) - Fix deferred
Package: openshift-serverless-clients (OpenShif
GHSA
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connecti
ghsa_unreviewed·2026-10-09
CVE-2026-94439 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connecti
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
VulDB
Google nethttp up to 1.26.8/1.27.1 HTTP Server request smuggling (EUVD-2026-95428)
vuldb·2026-10-09·CVSS 7.5
CVE-2026-94439 [HIGH] Google nethttp up to 1.26.8/1.27.1 HTTP Server request smuggling (EUVD-2026-95428)
A vulnerability was found in Google nethttp up to 1.26.8/1.27.1 and classified as problematic. This affects an unknown part of the component HTTP Server Handler. The manipulation results in http request smuggling.
This vulnerability is reported as CVE-2026-94439. The attack can be launched remotely. No exploit exists.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
2026-10-08
Published