---
title: "CVE-2026-56866: HTTP/1 client connection desynchronization after CONNECT rejection in net/http"
url: https://erroneo.us/security/cve/CVE-2026-56866/
description: "CVE-2026-56866 (Go standard library net/http): When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-10-08
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-56866"
kev: false
cvss: 7.5
epss: 0.00309
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-56866: HTTP/1 client connection desynchronization after CONNECT rejection in net/http

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.3% , percentile 22: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 22% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Editorial verdict: Patch this week. Go October 2026 Security Releases: 16 Stdlib Fixes — Rebuild and redeploy Go services with Go 1.27.3 or 1.26.10 this week, starting with internet-facing HTTP/2 servers and reverse proxies; none of these bugs is known to be exploited.

## What it is

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

## Affected products (CVE record)

- Go standard library net/http: < 1.26.9, 1.27.0-0 < 1.27.2
- Go standard library net/http/httputil: < 1.26.9, 1.27.0-0 < 1.27.2

## Severity

- CISA-ADP CVSS 3.1: 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.31% probability of exploitation activity in the next 30 days; percentile 22.

## Sources

- [CVE.org record CVE-2026-56866](https://www.cve.org/CVERecord?id=CVE-2026-56866)
- [NVD entry CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866)
- [go.dev](https://go.dev/cl/847306)
- [go.dev](https://go.dev/issue/81740)
- [groups.google.com](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI)
- [pkg.go.dev](https://pkg.go.dev/vuln/GO-2026-6605)

---
Source page: https://erroneo.us/security/cve/CVE-2026-56866/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt