7.5

CVE-2026-56866: go standard library net/http HTTP Request/Response Smuggling

CVSS: 7.5v3.1HighAwaiting analysis
AliasesUBUNTU-CVE-2026-56866DEBIAN-CVE-2026-56866CGA-226r-w7ch-46v8
Published 08-10-2026Last modified 09-10-2026
Open JSON

Vulnerability summary

CVE-2026-56866 is a high (CVSS 7.5) HTTP Request/Response Smuggling vulnerability in go standard library net/http. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.3% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.31%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 10
MGASA-2026-0497OPENSUSE-SU-2026:12093-1OPENSUSE-SU-2026:12101-1OPENSUSE-SU-2026:12112-1OPENSUSE-SU-2026:22093-1OPENSUSE-SU-2026:22095-1

Timeline

  1. 08-10-2026
    PublishedVulnerability first disclosed.
  2. 09-10-2026
    Last modifiedVulnerability information updated.

Description

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.31%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

09-10-202621-10-2026
EPSS score
0.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard200 products
  • aactl< 0.4.12-r79
  • access-log-exporter-fips< 0.4.22-r1
  • acm-controller-fips< 1.10.0-r1
  • actions-runner-controller< 0.15.0-r1
  • actions-runner-controller-fips< 0.15.0-r1

1 vendor · 200 products · Showing 200 of 4066. Use Open JSON for the complete list.

References

10 links