CVE-2026-56866: Golang HTTP/1 Client Connection Desynchronization Vulnerability
Summary
CVE-2026-56866: HTTP/1 client connection desynchronization after CONNECT rejection in net/http. Affects golang across 2 version ranges.
< 1.26.9
>= 1.27.0-0, < 1.27.2
Fixed in 1.26.9 or 1.27.2, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
The same CVE-2026-56866 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, also known as Go, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other networked applications. The net/http package in Golang provides HTTP client and server implementations, allowing developers to handle HTTP requests and responses seamlessly. However, a vulnerability has been identified in the HTTP/1 client connection handling, specifically related to the handling of CONNECT requests.
Vulnerability Detail
The vulnerability arises when the http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body. In such cases, the body is written directly to the connection without proper framing after the request headers. If the server responds with a non-2xx keep-alive response, the connection is returned to the idle pool, potentially leading to desynchronization. This means that the server may misinterpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request, which can result in cross-user response poisoning, especially in reverse proxies that forward CONNECT requests.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.26.91.26.9 -
>= 1.27.0-0, < 1.27.21.27.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using non-empty Request.Body with CONNECT requests in your application until you can update to the patched version. This will prevent the server from misinterpreting the body bytes as part of a subsequent request.
Conclusion
In summary, CVE-2026-56866 is a significant vulnerability in the Golang HTTP/1 client that can lead to connection desynchronization and cross-user response poisoning. It is crucial to update to the patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for golang →
FAQ
CVE-2026-56866 is a vulnerability in the Golang HTTP/1 client that can lead to connection desynchronization and potential cross-user response poisoning.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow an attacker to inject requests into the connection pool, leading to unintended responses being sent to users.
Yes, the vulnerability has been patched in versions 1.26.9 and 1.27.2 of the Golang package.
As a temporary measure, avoid using non-empty Request.Body with CONNECT requests until you can update to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
