Skip to content
fr Sign in
7.5 High

CVE-2026-94439 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the…

Description

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

Affected products and versions

Product Affected versions Fixed in
net/http 1.27 1.27.0-0 → < 1.27.2 1.27.2
net/http 1.26 earliest → < 1.26.9 1.26.9

References

Timeline

  1. Published
  2. Last modified

Other CVEs of net/http

The 26 CVEs of net/http →
CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently 7.5 High CVE-2026-78667 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS)… 7.5 High CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream… 9.1 Critical CVE-2026-78660 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they… 7.5 High
Track this CVE