CVE-2026-116166: Go Session Cookie Secure Not Request Derivedcve-2026-116166-go-session-cookie-secure-not-request-derived
Session cookie is created with its Secure attribute bound to a static boot-time value ($1) instead of the security state of the client's actual connection. The kernel's single TCP listener is multiplexed into a plaintext-HTTP leg and a TLS leg that both receive the same raw handler, and a fixed-port reverse proxy re-issues requests upstream over HTTPS, so pe
