Threats affecting pkg:golang/net/http/httputil

CVE-2026-56866 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent interpretation of HTTP/1 CONNECT requests with non-empty bodies. When http.Transport sends such a CONNECT request, it writes the body without framing after headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, the connection is returned to the idle pool while the server may interpret trailing body bytes as a new pipelined HTTP/1.1 request. This desynchronization can cause response poisoning in reverse proxies that share the Transport, leading to cross-user response contamination.

CVE-2026-39825 is a medium severity vulnerability in the Go standard library's net/http/httputil ReverseProxy component. It involves inconsistent parsing of HTTP query parameters, where some parameters may be hidden from certain functions like Rewrite or Director but still forwarded by ReverseProxy. This leads to inconsistent interpretation of HTTP requests, classified as HTTP Request/Response Smuggling (CWE-444). No official patch or remediation guidance has been published, and no known exploits exist in the wild.