{"id":"CVE-2026-56866","published":"2026-10-08T23:17:01.620","lastModified":"2026-10-09T16:35:35.900","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-444"],"vendors":[],"products":[],"references":[{"url":"https://go.dev/cl/847306","tags":[]},{"url":"https://go.dev/issue/81740","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6605","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw occurs when Go's HTTP/1 CONNECT requests with request bodies are handled by Transport, causing body data to be written directly to the connection without proper framing. When a server rejects the CONNECT request with a non-2xx response, the connection gets returned to the idle pool with leftover body bytes that get interpreted as subsequent HTTP requests, leading to cross-user response poisoning in reverse proxy scenarios.","exploitability":"Exploitation requires a reverse proxy setup using httputil.ReverseProxy with a shared Transport that handles CONNECT requests with request bodies, making it moderately difficult but possible to trigger through specific network conditions and connection reuse patterns.","blast_radius":"The impact could affect multiple users in reverse proxy environments where CONNECT requests are forwarded through shared Transports, potentially allowing attackers to poison responses for other users by injecting HTTP requests into pooled connections.","remediation":"Upgrade to Go 1.23.0 or later, which includes a fix for this issue in the net/http package.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["http","proxy","reverse-proxy","connection-pooling"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:24:18.201Z"}}