CVE-2026-94439

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can exploit this behavior to conduct HTTP request smuggling through intermediate proxy servers, potentially bypassing security controls.

A moderate-impact flaw was found in the Go standard library net/http package, which is shipped in the golang and go-toolset components of Red Hat Enterprise Linux and used by many Go-based Red Hat products and components (including Red Hat Enterprise Linux AI, Red Hat In-Vehicle OS, and bundled components such as osbuild-composer and rhc). When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve HTTP requests from a connection that should be treated as an opaque tunnel. A remote, unauthenticated attacker who can reach the server through an intermediate proxy that treats the connection as tunneled can exploit this desynchronization to conduct HTTP request smuggling, potentially bypassing proxy-enforced security controls and accessing requests or responses intended for other users. Red Hat rates this flaw Moderate severity (CVSS 3.1 base score 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting the limited confidentiality and integrity impact. Because the impact is Moderate with a CVSS score below 7.0, fixes for the affected Red Hat products are currently deferred rather than scheduled for an immediate update, and the Red Hat In-Vehicle OS 2.0.z streams are out of support scope. The residual risk of deferral is limited to HTTP request smuggling against servers that accept HTTP/1 CONNECT requests and are deployed behind an intermediate proxy.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.