CVE-2026-94439
EPSS 0.4%Vendor patch released; no PoC, no KEV, no active exploitation chatter.
What: HTTP/1 CONNECT request handling flaw in HTTP servers that fail to hijack connections, allowing improper continuation of HTTP reads and potential request smuggling attacks.
Why it matters: Google patched this across multiple Apigee hybrid components (v1.15.9, October 21, 2026). No public PoC, no KEV listing, EPSS 0.23% (negligible). Chatter is purely vendor release notes bundling CVE-2026-94439 with dozens of others; no active exploitation signal or defender triage visible.
Where it's seen: Vendor security advisories for Apigee sub-components (redis, Cassandra client, Prometheus adapter, Istiod). Repetitive social media posts listing patched CVEs with no context or urgency language.
RISK: MODERATE — HTTP request smuggling class; Apigee-scoped, requires specific server misconfiguration.
Description
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.