Repository navigation
net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response #81744
Description
When an HTTP server handler sent a 2xx response to an HTTP/1 CONNECT request
and returned without hijacking the connection, the server improperly continued
to read and serve requests from the connection. Since a 2xx response to an
HTTP/1 CONNECT converts the connection into a tunnel, the server should not
treat the connection as continuing to contain HTTP.
The impact of this misbehavior is mostly limited to potential request smuggling,
where an intermediate proxy considers the data on the connection to be tunneled
and the server considers it to be HTTP.
The HTTP/1 server now always closes a connection after responding to a CONNECT
request, regardless of the response status.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-94439 and Go issue https://go.dev/issue/81744.
This was a PRIVATE track issue originally tracked in http://b/551900039.
Activity
thatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81907 (for 1.26), #81908 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847028 mentions this issue:
[release-branch.go1.27] net/http: avoid server reuse of connection after CONNECTgopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847108 mentions this issue:
[release-branch.go1.26] net/http: avoid server reuse of connection after CONNECT[release-branch.go1.27] net/http: avoid server reuse of connection af…
[release-branch.go1.26] net/http: avoid server reuse of connection af…
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847311 mentions this issue:
net/http: avoid server reuse of connection after CONNECT[-]security: fix CVE-2026-94439[/-][+]net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response[/+]net/http: avoid server reuse of connection after CONNECT