#response-smuggling

Go HTTP/2 client fixed for Content-Length smuggling risk

CVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.