CVE-2026-94439: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Go standard library net/http

The vulnerability occurs when a Go net/http server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection. According to HTTP semantics, a 2xx response to CONNECT upgrades the connection to a tunnel, so the server should stop interpreting the connection as HTTP. However, the server continues to read and serve HTTP requests, causing a mismatch with intermediate proxies that treat the connection as tunneled. This inconsistency can be exploited for HTTP request smuggling attacks, where the proxy and server have different views of the request boundaries.

The impact is primarily related to HTTP request smuggling, which can allow an attacker to bypass security controls or interfere with request routing by exploiting the inconsistent interpretation of the connection between the server and intermediate proxies. There is no indication of known exploits in the wild. The vulnerability does not directly cause denial of service or remote code execution but can facilitate further attacks relying on request smuggling.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the Go project advisory or release notes for current remediation guidance. Until a fix is available, users should be cautious when handling HTTP/1 CONNECT requests and consider mitigating request smuggling risks at the proxy or network level.