Repository navigation
net/http: HTTP/1 client connection desynchronization after CONNECT rejection #81740
Description
When http.Transport sends an HTTP/1 CONNECT request with a non-empty
Request.Body, it writes the body directly to the connection without
framing after the request headers. If the server rejects the CONNECT
request with a non-2xx keep-alive response, Transport returns the
connection to the idle pool. Because CONNECT requests do not have a
request body, the server may interpret the trailing body bytes as a
subsequent pipelined HTTP/1.1 request on the connection, leaving the
pooled connection desynchronized and causing the next caller that reuses
it to read the response to the injected request. In reverse proxies
(including httputil.ReverseProxy) that forward CONNECT requests through
a shared Transport, this can lead to cross-user response poisoning.
The HTTP/1 transport now closes a connection after sending a CONNECT
request, regardless of the response status.
In addition, ReverseProxy now rejects incoming CONNECT requests
with a 405 Method Not Allowed response. ReverseProxy has never handled
CONNECT requests in a useful fashion (it does not convert the
connection into a bidirectional tunnel), so we do not expect this
change to negatively affect any current users.
Thanks to Xclow3n (Rajat Raghav) for reporting this issue.
This is CVE-2026-56866 and Go issue https://go.dev/issue/81740.
This was a PRIVATE track issue originally tracked in http://b/534709195.
Activity
thatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81899 (for 1.26), #81900 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847027 mentions this issue:
[release-branch.go1.27] net/http, net/http/httputil: avoid post-CONNECT pool corruptiongopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847107 mentions this issue:
[release-branch.go1.26] net/http, net/http/httputil: avoid post-CONNECT pool corruption[release-branch.go1.27] net/http, net/http/httputil: avoid post-CONNE…
[release-branch.go1.26] net/http, net/http/httputil: avoid post-CONNE…
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847306 mentions this issue:
net/http, net/http/httputil: avoid post-CONNECT pool corruptionnet/http, net/http/httputil: avoid post-CONNECT pool corruption
[-]security: fix CVE-2026-56866[/-][+]net/http: HTTP/1 client connection desynchronization after CONNECT rejection[/+]