Threats Tagged 'ghsa-2gfw-j3c5-j46w'

CVE-2026-94439 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent handling of HTTP/1 CONNECT requests. When a server handler sends a 2xx response to such a request but does not hijack the connection, it incorrectly continues to process the connection as HTTP rather than as a tunnel. This behavior can lead to HTTP request smuggling, where intermediaries and the server have differing interpretations of the connection data.