Is CVE-2026-56866 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56866 being exploited in the wild.

How severe is CVE-2026-56866?

High severity, with a CVSS score of 7.5, published 8 October 2026.

Which products and versions are affected?

stdlib (Go) SEMVER:introduced=0,fixed=1.26.9,introduced=1.27.0-0,fixed=1.27.2.

Is there a fix for CVE-2026-56866?

Yes. stdlib (Go): upgrade to 1.27.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56866 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56866?

Check whether you run stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56866: Go net/http HTTP/1 client connection desynchronization after CONNECT rejection

CVE-2026-56866 · Severity: high · CVSS 7.5 · Published 2026-10-08

Go's HTTP client library can become desynchronized when a CONNECT request is rejected by a server. In reverse proxy scenarios, this allows an attacker to craft a CONNECT request with a malicious body that gets misinterpreted as pipelined HTTP requests, poisoning subsequent responses and exposing data from other users sharing the same pooled connection.

Technologies: stdlib (Go). Vendors: Go.

Quick answers

Is CVE-2026-56866 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56866 being exploited in the wild.
How severe is CVE-2026-56866?: High severity, with a CVSS score of 7.5, published 8 October 2026.
Which products and versions are affected?: stdlib (Go) SEMVER:introduced=0,fixed=1.26.9,introduced=1.27.0-0,fixed=1.27.2.
Is there a fix for CVE-2026-56866?: Yes. stdlib (Go): upgrade to 1.27.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56866 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56866?: Check whether you run stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stdlib (Go): upgrade to 1.27.2 or later
```
go get stdlib@v1.27.2
```

Technical details

HTTP/1 clients that send CONNECT requests with a non-empty Request.Body write the body without framing; if the server rejects the request with a non-2xx keep-alive response, the transport returns the connection to the idle pool. The server then interprets trailing body bytes as pipelined requests, desynchronizing the connection. In reverse proxies forwarding CONNECT through a shared Transport, this enables cross-user response poisoning. The fix closes connections after CONNECT requests regardless of response status, and ReverseProxy now rejects CONNECT with 405 Method Not Allowed.

Affected products

golang Go <unknown>

Identifiers

CVE-2026-56866
GO-2026-6605

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.