net/http/httputil vulnerabilities

2 known vulnerabilities in net/http/httputil from Go standard library. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  net/http: Inconsistent Interpretation of HTTP Requests

  CVE-2026-56866Oct 8, 2026Go standard library

  When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport

• 7.5 High severity

  net/http/httputil: Inconsistent Interpretation of HTTP Requests

  CVE-2022-2880Oct 14, 2022Go standard libraryEPSS 1.41%

  Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After