PT-2026-23080 · Pingora · Pingora
Rajat Raghav
·
Published
2026-03-04
·
Updated
2026-03-12
·
CVE-2026-2833
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Pingora versions prior to 0.8.0
Description
An HTTP request smuggling issue (CWE-444) exists in Pingora's handling of HTTP/1.1 connection upgrades. The issue arises when the proxy reads a request with an Upgrade header and forwards the remaining bytes on the connection to a backend before the backend accepts the upgrade. This allows an attacker to send a malicious payload after a request containing an Upgrade header, which the backend may interpret as a subsequent request header, bypassing security controls. This can lead to bypassing proxy-level ACL controls and WAF logic, poisoning caches and upstream connections, and performing cross-user attacks by hijacking sessions or smuggling requests. Cloudflare's CDN infrastructure was not affected. The vulnerable component is the handling of the
Upgrade header in HTTP requests.Recommendations
Upgrade to Pingora version 0.8.0 or higher.
As a workaround, return an error on requests with the
Upgrade header present in request filter logic to stop processing bytes beyond the request header and disable downstream connection reuse.Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pingora