CVE-2026-94439 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
An HTTP/1 server mishandles 2xx CONNECT responses, leading to request smuggling via connection desynchronization between proxies and servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-94439?
CVE-2026-94439 is a high-severity vulnerability in Go standard library net/http, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
Weakness: CWE-444
Which versions are affected by CVE-2026-94439?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.26.9, 1.27.2 |
stdlib Go | All versions | 1.26.9, 1.27.2 |
How do I fix CVE-2026-94439?
Upgrade golang to a fixed version for your release line: 1.26.9 or 1.27.2.
Is CVE-2026-94439 being exploited?
There is no known exploitation of CVE-2026-94439 in the wild and no public exploit code.
Sources
Also known as AZL-108222, AZL-108239, AZL-108468, AZL-108543, BELL-CVE-2026-94439, BIT-golang-2026-94439 and 2206 more.