Go net/http CVE-2026-56866

Exploitation requires a very specific chain, not a default single-request attack: the affected Go service must act as a reverse proxy (e.g. httputil.ReverseProxy) or otherwise forward HTTP/1 CONNECT requests with a non-empty Request.Body through a Transport whose connections are pooled and shared across callers; the upstream server must reject the CONNECT with a non-2xx keep-alive (connection-reuse) response rather than closing the connection; and a subsequent unrelated caller must reuse the now-desynchronized idle connection. Limiting factors that reduce real-world exposure: it applies to HTTP/1 CONNECT handling only (not HTTP/2), it depends on the proxy forwarding CONNECT bodies and on a pooled/shared Transport, it depends on backend keep-alive-on-rejection behavior, and the cross-user impact hinges on connection-pool reuse timing. Deployments that do not proxy CONNECT, do not share Transports across users, or run patched versions (net/http ≥1.26.9 or ≥1.27.2) are not exposed.

Signals are mixed and point to a moderate, configuration-dependent risk rather than a widespread emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) frames this as a network-reachable, unauthenticated, low-complexity confidentiality issue, consistent with the CWE-444 (HTTP Request/Response Smuggling) classification and the cross-user response-poisoning described. However, the exploitation-probability signals are uniformly low: EPSS is 0.17% at the 5th percentile, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced - so the status is 'no public exploit identified at time of analysis.' There is tension between the CVSS AC:L rating and the described mechanics: successful cross-user poisoning requires a specific chain (proxy forwards a CONNECT with a body, backend returns a non-2xx keep-alive response, and the desynchronized connection is then reused by another caller), which in practice carries a race/timing and configuration dependency that argues for higher attack complexity than AC:L suggests. Net assessment: a genuine, patch-worthy defect in an extremely widely used library, but a narrow exploitable condition and low observed exploitation activity make it a prioritize-and-patch item rather than a drop-everything KEV-grade threat.

An attacker sends an HTTP/1 CONNECT request carrying a non-empty body to a Go-based reverse proxy (e.g. httputil.ReverseProxy) that forwards it through a shared http.Transport to a backend. The backend rejects the CONNECT with a non-2xx keep-alive response, so the proxy returns the connection to the idle pool while the trailing body bytes remain buffered as what looks like a pipelined request; the next unrelated user that reuses that pooled connection then receives the response to the attacker-injected request. No public exploit code is referenced, so this is a demonstrated mechanism rather than an observed in-the-wild campaign.