CVE-2026-56866 Overview
CVE-2026-56866 is an HTTP request smuggling vulnerability in the Go standard library's net/http package. When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without proper framing. If the server rejects the CONNECT with a non-2xx keep-alive response, Transport returns the connection to the idle pool in a desynchronized state. The next caller that reuses the connection may read the response to an attacker-injected request. In reverse proxy deployments using httputil.ReverseProxy, this enables cross-user response poisoning.
Critical Impact
Shared http.Transport instances in reverse proxies can leak responses across users, breaking tenant isolation and enabling response poisoning via injected pipelined requests.
Affected Products
- Go standard library net/http package (http.Transport)
- net/http/httputil package (httputil.ReverseProxy)
- Any Go application forwarding CONNECT requests through a shared Transport
Discovery Timeline
- 2026-10-08 - CVE-2026-56866 published to NVD
- 2026-10-09 - Last updated in NVD database
Technical Details for CVE-2026-56866
Vulnerability Analysis
The flaw is classified as HTTP Request/Response Smuggling [CWE-444]. The HTTP/1.1 CONNECT method is designed to establish a tunnel through a proxy and does not carry a request body. However, http.Transport does not enforce this: when a caller provides a non-empty Request.Body on a CONNECT request, Transport writes those body bytes directly onto the TCP connection immediately after the request headers, without Content-Length or Transfer-Encoding: chunked framing.
When the upstream server rejects the CONNECT with a keep-alive non-2xx response, Transport considers the connection reusable and places it back in the idle pool. The trailing body bytes remain unread on the wire. The server, which never consumed a body for CONNECT, interprets those bytes as the beginning of a new pipelined HTTP/1.1 request on the same connection.
Root Cause
The root cause is a protocol state desynchronization between client and server. http.Transport conflates two assumptions: that CONNECT carries no body, and that a non-2xx keep-alive response leaves the connection in a clean state. When a caller violates the first assumption, the second no longer holds. The attacker-controlled body becomes a smuggled request from the server's perspective.
Attack Vector
In a reverse proxy using httputil.ReverseProxy with a shared http.Transport, an attacker sends a CONNECT request through the proxy with a crafted body containing a complete HTTP request. The upstream rejects the CONNECT with a non-2xx keep-alive response. The proxy returns the connection to the pool. The next unrelated user whose request reuses that connection receives the response to the attacker's smuggled request. This enables response poisoning, credential leakage, and cache contamination across tenants. See Go.dev Vulnerability GO-2026-6605 for upstream details.
Detection Methods for CVE-2026-56866
Indicators of Compromise
- Unexpected HTTP method tokens (for example GET, POST) appearing in upstream server logs immediately after a rejected CONNECT request on the same TCP connection.
- Clients receiving responses whose Host, path, or body do not correspond to any request they sent.
- Elevated rates of 400 or 408 responses on connections previously used for CONNECT tunneling.
Detection Strategies
- Audit Go source for callers constructing CONNECT requests with a non-nil Request.Body and flag them for review.
- Correlate proxy access logs with upstream logs to detect request/response pairings that cross user or session boundaries.
- Deploy HTTP smuggling detection signatures on web application firewalls that monitor CONNECT traffic for trailing request-like byte patterns.
Monitoring Recommendations
- Instrument httputil.ReverseProxy deployments with per-request transaction IDs and verify response correlation at the client edge.
- Monitor Go runtime version inventories across build pipelines and container images to track exposure to the vulnerable net/http package.
- Alert on anomalous connection reuse patterns in idle connection pools under high CONNECT volume.
How to Mitigate CVE-2026-56866
Immediate Actions Required
- Upgrade Go to the patched release that includes the fix referenced in Go.dev CL 847306 and rebuild all affected binaries.
- Audit code paths that construct CONNECT requests and remove any assignment of Request.Body for CONNECT methods.
- For reverse proxies that forward CONNECT, consider isolating CONNECT traffic to a dedicated Transport that is not shared across users.
Patch Information
The Go team addressed this issue in the standard library via the change tracked at Go.dev CL 847306 and announced on the golang-announce mailing list. The upstream issue is tracked as Go Issue 81740 and the vulnerability database entry is GO-2026-6605. Rebuild all Go binaries against the patched toolchain; vendored dependencies that import net/http are not sufficient to carry the fix.
Workarounds
- Strip or reject non-empty bodies on CONNECT requests before they reach http.Transport.
- Disable HTTP keep-alive on Transports that proxy CONNECT by setting Transport.DisableKeepAlives = true until patching is complete.
- Use separate http.Transport instances per user or tenant to prevent cross-user connection reuse in reverse proxy scenarios.
# Verify installed Go toolchain version and update
go version
# Update to a patched release, then rebuild
go install golang.org/dl/go<patched-version>@latest
go build -trimpath ./...
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
