CVE-2026-94439: net/http 0 to before 1.26.9, 1.27.0-0 to before 1.27.2

Affected technology

net/http · 0 to before 1.26.9, 1.27.0-0 to before 1.27.2
Go standard library

Component: Not specified by the source
Function: chunkWriter.writeHeader, CanonicalHeaderKey, Client.CloseIdleConnections, Client.Do, Client.Get, Client.Head, Client.Post, Client.PostForm, ClientConn.Close, ClientConn.RoundTrip, Cookie.String, Cookie.Valid, CrossOriginProtection.AddInsecureBypassPattern, CrossOriginProtection.AddTrustedOrigin, CrossOriginProtection.Check, Dir.Open, Error, Get, Handle, HandleFunc, HandlerFunc.ServeHTTP, Head, Header.Add, Header.Del, Header.Get, Header.Set, Header.Values, Header.Write, Header.WriteSubset, ListenAndServe, ListenAndServeTLS, NewRequest, NewRequestWithContext, NotFound, ParseCookie, ParseSetCookie, ParseTime, Post, PostForm, ProxyFromEnvironment, ReadRequest, ReadResponse, Redirect, Request.AddCookie, Request.BasicAuth, Request.Cookie, Request.Cookies, Request.CookiesNamed, Request.FormFile, Request.FormValue, Request.MultipartReader, Request.ParseForm, Request.ParseMultipartForm, Request.PostFormValue, Request.Referer, Request.SetBasicAuth, Request.UserAgent, Request.Write, Request.WriteProxy, Response.Cookies, Response.Location, Response.Write, ResponseController.EnableFullDuplex, ResponseController.Flush, ResponseController.Hijack, ResponseController.SetReadDeadline, ResponseController.SetWriteDeadline, Serve, ServeContent, ServeFile, ServeFileFS, ServeMux.Handle, ServeMux.HandleFunc, ServeMux.ServeHTTP, ServeTLS, Server.Close, Server.ListenAndServe, Server.ListenAndServeTLS, Server.Serve, Server.ServeTLS, Server.SetKeepAlivesEnabled, Server.Shutdown, SetCookie, Transport.CancelRequest, Transport.Clone, Transport.CloseIdleConnections, Transport.NewClientConn, Transport.RoundTrip, body.Close, body.Read, bodyEOFSignal.Close, bodyEOFSignal.Read, bodyLocked.Read, bufioFlushWriter.Write, cancelTimerBody.Close, cancelTimerBody.Read, checkConnErrorWriter.Write, chunkWriter.Write, connReader.Read, connectMethodKey.String, expectContinueReader.Close, expectContinueReader.Read, extraHeader.Write, fileHandler.ServeHTTP, fileTransport.RoundTrip, globalOptionsHandler.ServeHTTP, gzipReader.Close, gzipReader.Read, http1ClientConn.Close, http1ClientConn.RoundTrip, http2ClientConn.RoundTrip, http2Handler.ServeHTTP, http2ResponseWriter.Flush, http2ResponseWriter.FlushError, http2ResponseWriter.Push, http2RoundTripper.RoundTrip, http3ServerHandler.ServeHTTP, initALPNRequest.ServeHTTP, loggingConn.Close, loggingConn.Read, loggingConn.Write, maxBytesReader.Close, maxBytesReader.Read, onceCloseListener.Close, persistConn.Read, persistConnWriter.ReadFrom, persistConnWriter.Write, populateResponse.Write, populateResponse.WriteHeader, readTrackingBody.Close, readTrackingBody.Read, readWriteCloserBody.CloseWrite, readWriteCloserBody.Read, redirectHandler.ServeHTTP, response.Flush, response.FlushError, response.Hijack, response.ReadFrom, response.Write, response.WriteHeader, response.WriteString, serverHandler.ServeHTTP, socksDialer.DialWithConn, socksUsernamePassword.Authenticate, stringWriter.WriteString, timeoutHandler.ServeHTTP, timeoutWriter.Write, timeoutWriter.WriteHeader, transportReadFromServerError.Error, unencryptedHTTP2Request.ServeHTTP

What an attacker can do

The source does not specify what an attacker can achieve.