CVE-2026-56866: Go stdlib HTTP/1 Client Connection Desynchronization Vulnerability
Summary
CVE-2026-56866: HTTP/1 client connection desynchronization after CONNECT rejection in net/http. Affects stdlib across 2 version ranges.
< 1.26.9
>= 1.27.0-0, < 1.27.2
Fixed in 1.26.9 or 1.27.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
The same CVE-2026-56866 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Go standard library (stdlib) provides essential packages for building web servers and clients, including the net/http package, which facilitates HTTP communication. This package is widely used for its simplicity and efficiency in handling HTTP requests and responses. However, it is susceptible to a vulnerability that can lead to connection desynchronization when handling HTTP/1 CONNECT requests, particularly when a non-empty request body is involved.
Vulnerability Detail
The vulnerability arises when the http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body. In this scenario, the body is written directly to the connection without proper framing after the request headers. If the server responds with a non-2xx keep-alive response, the connection is returned to the idle pool, leaving it desynchronized. This can result in the next caller that reuses the connection reading the response to an injected request, leading to potential cross-user response poisoning, especially in reverse proxies that forward CONNECT requests.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.26.91.26.9go get stdlib@v1.26.9 -
>= 1.27.0-0, < 1.27.21.27.2go get stdlib@v1.27.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using HTTP/1 CONNECT requests with non-empty request bodies, or implement additional checks to ensure that connections are properly managed and desynchronized connections are not reused.
Conclusion
CVE-2026-56866 is a critical vulnerability in the Go standard library's HTTP/1 client that can lead to serious security issues if not addressed. It is essential for developers using this library to update to the latest patched versions and implement best practices to mitigate risks.
See every vulnerability recorded for stdlib →
FAQ
CVE-2026-56866 is a vulnerability in the Go standard library's HTTP/1 client that can lead to connection desynchronization and potential cross-user response poisoning.
If your application uses the Go stdlib for HTTP communication and handles CONNECT requests, it may be vulnerable to this issue, potentially allowing unintended responses to be sent to users.
The vulnerability affects versions prior to 1.26.9 and 1.27.2. It is recommended to update to these patched versions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Without requiring access to the code, you can check your application's Gopkg.lock file at Vulert's playground: Vulert Scanner.
If an immediate update is not possible, consider implementing workarounds such as avoiding non-empty request bodies in CONNECT requests or ensuring proper connection management.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
