Product · Go standard library

net/http/httputil

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 7.5

CVE-2026-56866

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport…

Go standard library net/http net/http/httputil renovate Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 8, 2026