Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-94439 Details

Description

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://go.dev/cl/847311	[email protected]
https://go.dev/issue/81744	[email protected]
https://groups.google.com/g/golang-announce/c/U2fTuyDJznI	[email protected]
https://pkg.go.dev/vuln/GO-2026-6613	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-444	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')	CISA-ADP

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 9, 2026	CVE Modified	CISA-ADP
Oct 8, 2026	New CVE Received	[email protected]