Threats Tagged 'ghsa-f5vf-8pvc-394g'

CVE-2026-56866 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent interpretation of HTTP/1 CONNECT requests with non-empty bodies. When http.Transport sends such a CONNECT request, it writes the body without framing after headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, the connection is returned to the idle pool while the server may interpret trailing body bytes as a new pipelined HTTP/1.1 request. This desynchronization can cause response poisoning in reverse proxies that share the Transport, leading to cross-user response contamination.