CVE-2026-78660: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Go standard library net/http

The vulnerability arises from the Go standard library's net/http package handling of malformed framing-related headers in HTTP/2. While these headers do not interfere with HTTP/2 framing, the Go HTTP/2 implementation may forward responses containing such headers to HTTP/1 clients when used as a reverse proxy. If the HTTP/1 client does not strictly enforce header validation, this discrepancy can be exploited to perform HTTP response smuggling, classified under CWE-444 (Inconsistent Interpretation of HTTP Requests).

This vulnerability can allow an attacker to perform HTTP response smuggling attacks when the Go net/http package is used as a reverse proxy between HTTP/2 and HTTP/1 clients. Such attacks can lead to security issues like cache poisoning, cross-user data leakage, or bypassing security controls depending on the client behavior. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Users should monitor official Go project advisories for updates and consider applying any forthcoming patches promptly. Until a fix is available, cautious deployment of the net/http reverse proxy functionality and strict validation on HTTP/1 clients may reduce risk.