{"id":"CVE-2026-94439","published":"2026-10-08T23:17:04.760","lastModified":"2026-10-09T17:16:50.703","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-444"],"vendors":[],"products":[],"references":[{"url":"https://go.dev/cl/847311","tags":[]},{"url":"https://go.dev/issue/81744","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6613","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An HTTP server incorrectly handles CONNECT requests by continuing to process HTTP requests on a connection that should have been converted into a tunnel. This can lead to request smuggling where proxies and servers interpret the same connection data differently, potentially allowing attackers to manipulate how requests are processed.","exploitability":"Exploitation requires an intermediate proxy that properly interprets the CONNECT response as a tunnel, combined with a vulnerable server that continues processing HTTP requests on the same connection, making it moderately difficult but possible to exploit.","blast_radius":"The impact is primarily limited to request smuggling scenarios in environments with proxy intermediaries, potentially allowing attackers to bypass security controls or manipulate request routing without direct data exposure.","remediation":"Upgrade to version 2.590 or later to fix the HTTP/1 CONNECT handling behavior.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["http","proxy","request-smuggling"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:23:48.608Z"}}