A Go net/http server that returns a 2xx response to an HTTP/1 CONNECT request without hijacking the underlying connection incorrectly continues to parse and serve HTTP requests on the same socket. Because a 2xx CONNECT normally turns the connection into a raw tunnel, the server should stop HTTP framing. The retained framing can create a desynchronization that allows an attacker to smuggle a request through an intermediate proxy where the connection is treated as a tunnel. The weakness is a protocol parsing and synchronization fault (CWE-444).

The affected package is the Go standard library’s net/http. The bug is tracked under GO-2026-6613 and applies to any Go release that has not yet incorporated that issue fix. No specific version numbers are listed, so all vulnerable deployments should verify whether the GO-2026-6613 change is present.

The CVSS score of 7.5 indicates high severity. EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Exploitation requires a client or intermediate proxy that can issue a CONNECT to the vulnerable server and then send data that the server will misinterpret as HTTP after a 2xx response. While active attacks are not well documented, the potential for request smuggling could let an attacker bypass proxy filtering or redirect traffic unnoticed, especially in environments where proxy and application server expectations differ.