CVE-2026-56866: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Go standard library net/http

The vulnerability arises when http.Transport sends an HTTP/1 CONNECT request containing a non-empty Request.Body. The body is written directly to the connection without proper framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, the connection is returned to the idle pool. Since CONNECT requests should not have a body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request, causing the connection to become desynchronized. When this connection is reused, the next caller may read a response to the injected request, enabling cross-user response poisoning in reverse proxies that forward CONNECT requests through a shared Transport.

This vulnerability can lead to cross-user response poisoning in reverse proxies using the affected Go net/http Transport implementation. An attacker could cause a response intended for one user to be delivered to another, potentially leaking sensitive information or causing incorrect application behavior. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid forwarding CONNECT requests with non-empty bodies through shared Transports or implement strict validation to prevent sending bodies with CONNECT requests.