Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-94439 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the…

Description

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

Produits et versions touchés

Produit Versions touchées Corrigé en
net/http 1.27 1.27.0-0 → < 1.27.2 1.27.2
net/http 1.26 premières → < 1.26.9 1.26.9

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de net/http

Les 26 CVE de net/http →
CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently 7.5 Élevée CVE-2026-78667 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS)… 7.5 Élevée CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream… 9.1 Critique CVE-2026-78660 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they… 7.5 Élevée
Suivre cette CVE