CVE-2026-94439

A moderate-impact flaw was found in the Go standard library net/http package, which is shipped in the golang and go-toolset components of Red Hat Enterprise Linux and used by many Go-based Red Hat products and components (including Red Hat Enterprise Linux AI, Red Hat In-Vehicle OS, and bundled components such as osbuild-composer and rhc). When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve HTTP requests from a connection that should be treated as an opaque tunnel. A remote, unauthenticated attacker who can reach the server through an intermediate proxy that treats the connection as tunneled can exploit this desynchronization to conduct HTTP request smuggling, potentially bypassing proxy-enforced security controls and accessing requests or responses intended for other users. Red Hat rates this flaw Moderate severity (CVSS 3.1 base score 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting the limited confidentiality and integrity impact. Because the impact is Moderate with a CVSS score below 7.0, fixes for the affected Red Hat products are currently deferred rather than scheduled for an immediate update, and the Red Hat In-Vehicle OS 2.0.z streams are out of support scope. The residual risk of deferral is limited to HTTP request smuggling against servers that accept HTTP/1 CONNECT requests and are deployed behind an intermediate proxy.