CVE-2026-56866

Summary

The flaw occurs when Go's HTTP/1 CONNECT requests with request bodies are handled by Transport, causing body data to be written directly to the connection without proper framing. When a server rejects the CONNECT request with a non-2xx response, the connection gets returned to the idle pool with leftover body bytes that get interpreted as subsequent HTTP requests, leading to cross-user response poisoning in reverse proxy scenarios.

Exploitability

Exploitation requires a reverse proxy setup using httputil.ReverseProxy with a shared Transport that handles CONNECT requests with request bodies, making it moderately difficult but possible to trigger through specific network conditions and connection reuse patterns.

Blast radius

The impact could affect multiple users in reverse proxy environments where CONNECT requests are forwarded through shared Transports, potentially allowing attackers to poison responses for other users by injecting HTTP requests into pooled connections.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Go 1.23.0 or later, which includes a fix for this issue in the net/http package.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.