CVE-2026-56866

A flaw of moderate impact was found in the Go standard library net/http package, which is shipped by a broad range of Red Hat products, including Red Hat Enterprise Linux (golang and go-toolset components), Red Hat Enterprise Linux AI, OpenShift Container Platform and other Go-based components across Red Hat's portfolio. When http.Transport sends an HTTP/1 CONNECT request that carries a non-empty request body, the body is written to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the desynchronized connection to the shared idle pool, and the trailing body bytes can be interpreted by the server as a subsequent pipelined request. A remote attacker able to send requests through a reverse proxy (including httputil.ReverseProxy) that forwards CONNECT requests via a shared Transport could exploit this to poison the responses received by other users of the pooled connection, potentially exposing sensitive information or serving unintended content to them. Red Hat rates this flaw MODERATE (CVSS 6.5, limited confidentiality and integrity impact with no availability impact), which is lower than the CISA score of 7.5 (IMPORTANT) based on a confidentiality-only vector; Red Hat's assessment reflects that the exposure requires a shared reverse-proxy deployment that forwards CONNECT requests with bodies and yields low confidentiality and integrity impact. For most affected Red Hat products the fix is deferred because the flaw is rated MODERATE severity with a CVSS score below 7.0, so the residual risk of cross-user response poisoning in such proxy deployments remains until a fix is delivered; for a subset of affected products fixes are being pursued by their maintaining teams, and some affected streams are out of active support.