PT-2025-22502 · Cloudflare · Pingora

Published

2025-04-25

·

Updated

2025-08-06

·

CVE-2025-4366

CVSS v3.1

8.0

High

VectorAV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Pingora versions prior to the fixed version
Description A request smuggling issue was identified in Pingora's proxying framework, pingora-proxy, allowing malicious HTTP requests to be injected via manipulated request bodies on cache HITs. This leads to unauthorized request execution and potential cache poisoning. The issue could lead to request smuggling in cases where Pingora's proxying framework is used for caching, allowing an attacker to manipulate headers and URLs in subsequent requests made on the same HTTP/1.1 connection.
Recommendations For versions prior to the fixed version, update to the latest version that includes the fix for this issue, as referenced in the commit https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff. As a temporary workaround, consider restricting access to the pingora-proxy framework to minimize the risk of exploitation.

Fix

HTTP Request/Response Smuggling

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2025-10363
CVE-2025-4366
GHSA-3QMP-G57H-RXF2
GHSA-93C7-7XQW-W357
RUSTSEC-2025-0037

Affected Products

Pingora