CVE-2026-94439: go standard library net/http HTTP Request/Response Smuggling

CVSS: 7.5v3.1HighAwaiting analysis

AliasesUBUNTU-CVE-2026-94439DEBIAN-CVE-2026-94439CGA-222h-j74w-v34r+8825 more

Published 08-10-2026Last modified 09-10-2026

Vulnerability summary

CVE-2026-94439 is a high (CVSS 7.5) HTTP Request/Response Smuggling vulnerability in go standard library net/http. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.1% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.32%

0%100%

Low · Change unavailable

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 10

MGASA-2026-0497 OPENSUSE-SU-2026:12093-1 OPENSUSE-SU-2026:12101-1 OPENSUSE-SU-2026:12112-1 OPENSUSE-SU-2026:22093-1 OPENSUSE-SU-2026:22095-1+5 more

Timeline

08-10-2026
PublishedVulnerability first disclosed.
09-10-2026
Last modifiedVulnerability information updated.

Description

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.5

EPSS trend

Probability

0.32%

Chance of exploitation in the next 30 days

Percentile

23%

Versus all other CVEs

30-day change

Change unavailable

09-10-202621-10-2026

EPSS score

0.32%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Chainguard200 products

aactl< 0.4.12-r79
access-log-exporter-fips< 0.4.22-r1
acm-controller-fips< 1.10.0-r1
actions-runner-controller< 0.15.0-r1
actions-runner-controller-fips< 0.15.0-r1

addon-resizer< 1.8.24-r7
addon-resizer-fips< 1.8.24-r7
ageAll versions (No fix recorded)
age-fipsAll versions (No fix recorded)
agentbeat-fips< 9.2.7-r30
agentbeat-fips-8.19< 8.19.23-r1
alloydb-auth-proxy-fips< 1.17.0-r2
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloader-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translator-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-fips< 1.300074.0-r2
amazon-cloudwatch-agent-operator-fips< 3.7.0-r8
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fipsAll versions (No fix recorded)
amazon-ecs-agent-fips< 1.108.0-r1
amazon-ecs-cni-plugins-fips< 2024.9.0_git20260617-r8 | All versions (No fix recorded)
amazon-eks-ami-fips< 20261003-r1
amazon-k8s-cni-fips< 1.23.2-r1
amazon-k8s-cni-init-fips< 1.23.2-r1
amazon-k8s-cni-init-fips-compat< 1.23.2-r2 | All versions (No fix recorded)
amazon-ssm-agent-ecs-exec-fips< 3.3.5512.0-r1
amazon-ssm-agent-fips< 3.3.5512.0-r1
amazon-vpc-cni-pluginsAll versions (No fix recorded)
amazon-vpc-cni-plugins-fipsAll versions (No fix recorded)
ansible-operator-fips< 1.42.3-r17
apache-beam-java-11-sdk< 2.77.0-r1
apache-beam-java-17-sdk< 2.77.0-r1 | < 2.77.0-r2
apache-beam-java-21-sdk< 2.77.0-r2 | < 2.77.0-r1
apache-beam-python-3.11-sdk< 2.77.0-r0
apache-beam-python-3.14-sdkAll versions (No fix recorded) | < 2.77.0-r1
apache-exporter< 1.1.1-r7
api-linter< 2.4.0-r1
apiserver-network-proxy-fips-0.34< 0.34.0-r15
apiserver-network-proxy-fips-0.34-agent< 0.34.0-r15
apiserver-network-proxy-fips-0.35< 0.35.0-r15 | All versions (No fix recorded)
apiserver-network-proxy-fips-0.35-agent< 0.35.0-r15
apiserver-network-proxy-fips-0.36< 0.36.0-r15
apiserver-network-proxy-fips-0.36-agentAll versions (No fix recorded) | < 0.36.0-r15
apiserver-network-proxy-fips-0.37< 0.37.0-r3 | All versions (No fix recorded)
apiserver-network-proxy-fips-0.37-agent< 0.37.0-r3
apko-fips< 1.4.10-r1
apm-server-fips-8.19< 8.19.23-r2
apm-server-fips-9.2< 9.2.8-r17
apm-server-fips-9.3< 9.3.8-r9
apm-server-fips-9.4< 9.4.8-r3 | < 9.4.8-r2
apm-server-fips-9.5< 9.5.5-r2
application-gateway-kubernetes-ingress-fips< 1.9.14-r1
argo-cd-3.3< 3.3.15-r1
argo-cd-3.3-compat< 3.3.15-r1
argo-cd-3.4< 3.4.10-r1
argo-cd-3.4-compat< 3.4.10-r1
argo-cd-fips-3.1< 3.1.16-r16
argo-cd-fips-3.1-compat< 3.1.16-r16
argo-cd-fips-3.2< 3.2.12-r27
argo-cd-fips-3.2-compat< 3.2.12-r27
argo-cd-fips-3.3< 3.3.15-r1
argo-cd-fips-3.3-compat< 3.3.15-r1
argo-cd-fips-3.4< 3.4.10-r1
argo-cd-fips-3.4-compat< 3.4.10-r1
argo-cd-fips-3.5< 3.5.4-r1
argo-cd-fips-3.5-compat< 3.5.4-r1
argo-events-fips< 1.9.11-r15
argo-rollouts-fips< 1.10.0-r4 | All versions (No fix recorded)
argo-workflow-controller-3.7All versions (No fix recorded) | < 3.7.18-r10
argo-workflow-controller-4.0< 4.0.12-r2
argo-workflow-controller-4.1< 4.1.4-r2
argo-workflow-controller-fips-3.7< 3.7.18-r10
argo-workflow-controller-fips-4.0< 4.0.13-r1
argo-workflow-controller-fips-4.1< 4.1.4-r1 | < 4.1.5-r0
argo-workflow-executor-3.7< 3.7.18-r10
argo-workflow-executor-4.1< 4.1.5-r0
argo-workflow-executor-fips-3.7< 3.7.18-r10
argo-workflow-executor-fips-4.0< 4.0.13-r1
argo-workflow-executor-fips-4.1All versions (No fix recorded) | < 4.1.5-r0
argo-workflows-3.7< 3.7.18-r10
argo-workflows-4.0< 4.0.12-r2
argo-workflows-4.1< 4.1.4-r2
argo-workflows-fips-3.7All versions (No fix recorded) | < 3.7.18-r10
argo-workflows-fips-4.0< 4.0.13-r1
argo-workflows-fips-4.1< 4.1.5-r0 | < 4.1.4-r1
argocd-image-updater-fips< 1.3.1-r1
athenz-cert-manager-issuer-fips< 0.0.9-r4
athenz-csi-driver-fips< 0.0.16-r9
athenz-csi-driver-fips-approver< 0.0.16-r9
atlantis< 0.48.1-r1
atlantis-fips< 0.48.1-r2
atlas< 1.3.0-r9
atlas-fips< 1.3.0-r11
auditbeat-9.3< 9.3.8-r17
auditbeat-fips-8.19< 8.19.23-r1
auditbeat-fips-9.2< 9.2.8-r25
auditbeat-fips-9.3< 9.3.8-r12
auditbeat-fips-9.4< 9.4.8-r1
auditbeat-fips-9.5< 9.5.5-r2
authentik-2026.5-go-server< 2026.5.7-r10
authentik-fips-2025.12-go-server< 2025.12.6-r19
authentik-fips-2026.2-go-server< 2026.2.7-r6
authentik-fips-2026.5-go-server< 2026.5.7-r12
authservice< 1.1.8-r6
authservice-fips< 1.1.8-r7
avmfix< 0.7.0-r9
avmfix-fips< 0.7.0-r13
aws-application-networking-k8s< 2.1.3-r5
aws-application-networking-k8s-fips< 2.1.3-r3
aws-ebs-csi-driver-1.58< 1.58.0-r15
aws-ebs-csi-driver-1.60< 1.60.1-r14
aws-ebs-csi-driver-1.61< 1.61.1-r10
aws-ebs-csi-driver-1.62< 1.62.0-r9
aws-ebs-csi-driver-1.63< 1.63.1-r8
aws-ebs-csi-driver-1.64< 1.64.0-r6
aws-ebs-csi-driver-fips-1.57< 1.57.1-r20 | < 1.57.1-r21
aws-ebs-csi-driver-fips-1.58< 1.58.0-r16
aws-ebs-csi-driver-fips-1.59< 1.59.0-r17
aws-ebs-csi-driver-fips-1.60< 1.60.1-r16
aws-ebs-csi-driver-fips-1.61< 1.61.1-r12
aws-ebs-csi-driver-fips-1.62< 1.62.0-r13
aws-ebs-csi-driver-fips-1.63< 1.63.1-r7
aws-ebs-csi-driver-fips-1.64< 1.64.0-r6
aws-ebs-csi-driver-fips-1.65< 1.65.0-r4
aws-ebs-csi-driver-fips-1.66< 1.66.1-r1
aws-efs-csi-driver-fips< 3.5.1-r3
aws-eks-pod-identity-agent-fips< 0.2.5-r1
aws-flb-cloudwatch< 1.9.5-r10
aws-flb-cloudwatch-fips< 1.9.5-r10
aws-flb-firehose< 1.7.3-r13
aws-flb-firehose-fips< 1.7.3-r11
aws-flb-kinesis-fips< 1.10.4-r9 | < 1.10.4-r8
aws-for-fluent-bit-init-fips< 3.5.0-r1
aws-fsx-csi-driver-fips< 1.11.0-r1
aws-iam-authenticator-fipsAll versions (No fix recorded) | < 0.7.20-r5
aws-lambda-runtime-interface-emulator-fips< 1.37-r3
aws-load-balancer-controller-fips< 3.6.0-r1
aws-network-policy-agent< 1.4.3-r1
aws-network-policy-agent-fips< 1.4.3-r1
aws-node-termination-handler< 1.25.6-r21
aws-node-termination-handler-fips< 1.25.6-r21
aws-nuke< 3.68.3-r1
aws-nuke-fips< 3.68.3-r1
aws-otel-collector< 0.50.0-r6
aws-otel-collector-fips< 0.50.0-r7
aws-otel-collector-healthcheck< 0.50.0-r6
aws-otel-collector-healthcheck-fips< 0.50.0-r7
aws-privateca-issuer-fips< 1.10.0-r1
aws-signer-notation-plugin-fips< 1.0.2292-r23 | < 1.0.2292-r24
aws-sigv4-proxy-fips< 1.13.1-r0
azcopy-fipsAll versions (No fix recorded) | < 10.32.8-r4
azure-metrics-exporter< 25.12.0-r7
azure-metrics-exporter-fips< 25.12.0-r3
azure-service-operator< 2.21.1-r2
azure-service-operator-fips< 2.21.1-r2
azure-vnet-cni< 1.9.2-r2
azuredisk-csi-1.34< 1.34.7-r1
azuredisk-csi-1.35< 1.35.0-r1
azuredisk-csi-fips-1.33< 1.33.13-r1
azuredisk-csi-fips-1.34< 1.34.7-r1 | All versions (No fix recorded)
azuredisk-csi-fips-1.35< 1.35.0-r1
azuredisk-csi-fips-1.36< 1.36.0-r1
azurefile-csi-1.33< 1.33.10-r12
azurefile-csi-fips-1.33< 1.33.10-r14
azurefile-csi-fips-1.34< 1.34.10-r1
azurefile-csi-fips-1.35< 1.35.10-r1
backup-restore-operator-10.0< 10.0.10-r1
backup-restore-operator-8.1< 8.1.9-r2
backup-restore-operator-fips-10.0All versions (No fix recorded) | < 10.0.10-r1
backup-restore-operator-fips-11.0< 11.0.3-r1
backup-restore-operator-fips-7.0< 7.0.11-r1
backup-restore-operator-fips-8.1< 8.1.9-r1
backup-restore-operator-fips-9.0< 9.0.8-r1
bank-vaults< 1.33.2-r5
bank-vaults-fips< 1.33.2-r6
bank-vaults-template< 1.33.2-r5
bank-vaults-template-fips< 1.33.2-r6
bank-vaults-vault-operator-fips< 1.24.1-r1
bento-fips< 1.22.0-r1
blob-csi-1.23< 1.23.11-r86
blob-csi-1.24< 1.24.11-r35
blob-csi-1.25< 1.25.10-r33
blob-csi-1.26< 1.26.17-r2
blob-csi-1.27< 1.27.11-r1
blob-csi-fips-1.23< 1.23.11-r90
blob-csi-fips-1.24< 1.24.11-r37
blob-csi-fips-1.25< 1.25.10-r31
blob-csi-fips-1.26< 1.26.17-r3
blob-csi-fips-1.27< 1.27.11-r1
blobfuse2-fips< 2.4.2-r24
blobfuse2-fips-health-monitorAll versions (No fix recorded)
bom< 0.8.0-r2
boring-registry-fips< 0.19.0-r9
boringssl-fips-static-20240407-toolsAll versions (No fix recorded)
buildah-fips< 1.45.1-r3
buildctl-fips< 0.34.0-r1
buildkitd-fips< 0.34.0-r1
buildkite-agent-3< 3.138.0-r1
buildkite-agent-fips-3< 3.138.0-r1
buildkite-agent-fips-4< 4.3.0-r1
buildtools-buildifier-fipsAll versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 4065. Use Open JSON for the complete list.

References

10 links

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities