When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade go-toolsetUpgrade golang-raceUpgrade golang-miscUpgrade golangUpgrade golang-testsUpgrade golang-binUpgrade golang-srcUpgrade delveUpgrade golang-docs | Oct 25, 2026 | Oct 20, 2026 |
| Alpine Linux | — | Upgrade go | Oct 15, 2026 | Oct 8, 2026 |
| Amazon_linux_2023 | — | Upgrade oci-add-hooks-debuginfoUpgrade amazon-ecr-credential-helperUpgrade golang-sharedUpgrade golang-binUpgrade golang-docsUpgrade golangUpgrade oci-add-hooksUpgrade oci-add-hooks-debugsourceUpgrade golang-testsUpgrade golang-srcUpgrade golang-miscUpgrade soci-snapshotter | Oct 28, 2026 | Oct 8, 2026 |
| Redhat_linux | — | Upgrade golang-miscUpgrade golang-raceUpgrade delveUpgrade golang-testsUpgrade delve-debugsourceNo solution existsUpgrade golang-binUpgrade golang-srcUpgrade golang-docsUpgrade go-toolsetUpgrade delve-debuginfoUpgrade golang | Oct 13, 2026 | Oct 8, 2026 |
| Rocky_linux | — | Upgrade delve-debuginfoUpgrade delveUpgrade go-toolsetUpgrade golang-binUpgrade golangUpgrade delve-debugsourceUpgrade golang-race | Oct 26, 2026 | Oct 21, 2026 |
| Ubuntu | — | Upgrade golang-1.22-srcUpgrade golang-1.22-goUpgrade golang-1.22 | Oct 19, 2026 | Oct 8, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub