---
title: "CVE-2026-94439: HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http"
url: https://erroneo.us/security/cve/CVE-2026-94439/
description: "CVE-2026-94439 (Go standard library net/http): When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-10-08
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-94439"
kev: false
cvss: 7.5
epss: 0.00315
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-94439: HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.3% , percentile 23: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 23% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Editorial verdict: Patch this week. Go October 2026 Security Releases: 16 Stdlib Fixes — Rebuild and redeploy Go services with Go 1.27.3 or 1.26.10 this week, starting with internet-facing HTTP/2 servers and reverse proxies; none of these bugs is known to be exploited.

## What it is

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

## Affected products (CVE record)

- Go standard library net/http: < 1.26.9, 1.27.0-0 < 1.27.2

## Severity

- CISA-ADP CVSS 3.1: 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.32% probability of exploitation activity in the next 30 days; percentile 23.

## Sources

- [CVE.org record CVE-2026-94439](https://www.cve.org/CVERecord?id=CVE-2026-94439)
- [NVD entry CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439)
- [go.dev](https://go.dev/cl/847311)
- [go.dev](https://go.dev/issue/81744)
- [groups.google.com](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI)
- [pkg.go.dev](https://pkg.go.dev/vuln/GO-2026-6613)

---
Source page: https://erroneo.us/security/cve/CVE-2026-94439/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt