golang security update (CVE-2026-56866)

The primary vulnerability (CVE-2026-56866) involves golang's http.Transport sending HTTP/1 CONNECT requests with a non-empty Request.Body, which is written directly to the connection without framing. If the server rejects the CONNECT request with a non-2xx keep-alive response, the connection is returned to the idle pool desynchronized, potentially allowing subsequent callers to read injected responses, leading to cross-user response poisoning in reverse proxies using shared Transports. Additionally, the HTTP/2 implementation's lax handling of malformed framing-related headers can cause response smuggling when forwarding to HTTP/1 clients (CVE-2026-78660). Lastly, multipart form parsing can bypass memory limits and read arbitrarily long lines into memory under certain conditions (CVE-2026-94440).

Successful exploitation of CVE-2026-56866 can lead to cross-user response poisoning in reverse proxies, potentially exposing sensitive data or causing incorrect responses to be delivered to users. CVE-2026-78660 may allow response smuggling attacks, which can manipulate HTTP responses and compromise client security. CVE-2026-94440 allows memory limit bypass during multipart form parsing, potentially leading to resource exhaustion or denial of service. The CVSS score of 7.5 indicates a high severity primarily due to confidentiality impact without requiring privileges or user interaction.

A patch is available for these vulnerabilities. Users should upgrade golang to versions >=1.17.3-52.oe2203sp4 or later where these issues are fixed. Applying the official update is the recommended remediation. No vendor advisory states that no action is required or that the issues are already mitigated without patching.