CVE-2026-94439

An HTTP server handler is vulnerable to request smuggling because it improperly handles HTTP/1 CONNECT requests. When the handler sends a 2xx response without hijacking the connection, it fails to stop treating the connection as HTTP, even though it has been converted into a tunnel. This discrepa...

CVE-2026-94439

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

CVE-2026-94439 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

CVE-2026-94439

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

CVE-2026-94439 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

CVE-2026-56866

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

CVE-2026-56866

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

CVE-2026-56866 HTTP/1 client connection desynchronization after CONNECT rejection in net/http

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

CVE-2026-56866 HTTP/1 client connection desynchronization after CONNECT rejection in net/http

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

CVE-2026-56866

The http.Transport component is vulnerable to a desynchronization issue when handling HTTP/1 CONNECT requests with a non-empty Request.Body . The underlying cause is that the transport writes the body directly to the connection without framing; if a server rejects the request with a non-2xx keep-...

GO-2026-6613 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

GO-2026-6605 HTTP/1 client connection desynchronization after CONNECT rejection in net/http

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

tfo-connect-bypass

Using TCP Fast Open to Bypass Syscall-based Networking Rules CVE-2026-63828/CVE-2026-72243 PoC TCP Fast Open TFO is a method of initializing and using a TCP connection where the client can send data in the initial SYN packet sent to the server. This extension to the TCP protocol was implemented f...

PoC-CVE-2026-23744

PoC-CVE-2026-23744 Remote Code Execution on MCPJam Inspector Reference https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6...

CVE-2026-23744-PoC

CVE-2026-23744-PoC MCP RCE Exploit Linux PoC to exploit /api/mcp/connect for remote command execution. Requirements pip install requests Usage python3 exploit.py Example: python3 exploit.py mcp.something.com Configuration edit in script attackerip = "YOURIP" port = 4444 Listener nc -lvnp 4444...

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://. Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to th...

CVE-2026-22019-libcurl-HTTP-2-CONNECT-Tunnel-Mixup

CVE-2026-22019 – libcurl HTTP/2 CONNECT Tunnel Mixup Program Code C simulation // curlhttp2tunnelmixup.c - Simulated libcurl handling CONNECT over HTTP/2 include void handlehttp2streamint streamid // Vulnerability: after CONNECT, the proxy mixes streams with the tunneled data if streamid == 0...

CVE-2026-2222-MQTT-Broker-CONNECT-Packet-Heap-Overflow

CVE-2026-2222 – MQTT Broker CONNECT Packet Heap Overflow Program Code C + Python // mqttbrokersim.c - Simulated vulnerable MQTT broker include include include struct mqttconnect char protocolname8; uint8t protocollevel; uint8t flags; uint16t keepalive; // remaining length field misinterpreted ;...

krustyloader-analysis

KrustyLoader Analysis This repository contains resources related to the analysis made on KrustyLoader and available on this blog post: https://www.synacktiv.com/publications/krustyloader-rust-malware-linked-to-ivanti-connectsecure-compromises. a Python script to extract and decrypt URL used by th...

CVE-2026-107585

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...