Google Go up to 1.26.8/1.27.1 net/http/httputil request smuggling

Summaryinfo

A vulnerability categorized as problematic has been discovered in Google Go up to 1.26.8/1.27.1. The affected element is an unknown function of the component net/http/httputil. Executing a manipulation can lead to request smuggling. This vulnerability is handled as CVE-2026-56866. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Google Go up to 1.26.8/1.27.1 and classified as problematic. This vulnerability affects an unknown functionality of the component net/http/httputil. The manipulation with an unknown input leads to a request smuggling vulnerability. The CWE definition for the vulnerability is CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. As an impact it is known to affect integrity. CVE summarizes:

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

This vulnerability was named CVE-2026-56866 since 06/23/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/10/2026).

Upgrading to version 1.26.9 or 1.27.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-95421) and CERT Bund (WID-SEC-2026-3841). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Golang Go

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

Version

• 1.26.0
• 1.26.1
• 1.26.2
• 1.26.3
• 1.26.4
• 1.26.5
• 1.26.6
• 1.26.7
• 1.26.8
• 1.27.0
• 1.27.1

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion