PT-2026-23081 · Pingora · Pingora

Rajat Raghav · Published 2026-03-04 · Updated 2026-03-12 · CVE-2026-2835

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Pingora versions prior to 0.8.0

Description An HTTP Request Smuggling issue exists due to improper parsing of HTTP/1.0 and Transfer-Encoding requests. The issue arises from allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, potentially desynchronizing request framing between Pingora and backend servers. This could allow attackers to bypass proxy-level access control lists and web application firewall logic, poison caches and upstream connections, and perform cross-user attacks by hijacking sessions or smuggling requests. Cloudflare's CDN infrastructure was not affected. The API endpoints are not explicitly mentioned. The vulnerable parameters or variables are not explicitly mentioned. The vulnerable functions are not explicitly mentioned.

Recommendations Upgrade to Pingora version 0.8.0 or higher. As a workaround, reject non-HTTP/1.1 requests, requests with invalid Content-Length, requests with multiple Transfer-Encoding headers, or requests with a Transfer-Encoding header that is not exactly “chunked”.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-2835

GHSA-262P-VJX5-45XH

GHSA-HJ7X-879W-VRP7

RUSTSEC-2026-0034

Affected Products

Pingora

References · 22

• https://osv.dev/vulnerability/GHSA-262p-vjx5-45xh · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0034 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2835 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hj7x-879w-vrp7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2835 · Security Note
• https://github.com/cloudflare/pingora · Note
• https://github.com/cloudflare/pingora/security/advisories/GHSA-hj7x-879w-vrp7 · Note
• https://t.me/cveNotify/155295 · Telegram Post
• https://twitter.com/cyberbivash/status/2029366502449709299 · Twitter Post
• https://twitter.com/CVEnew/status/2031137196368081299 · Twitter Post
• https://twitter.com/pulsepatchio/status/2029932940029825136 · Twitter Post
• https://rustsec.org/advisories/RUSTSEC-2026-0034.html · Note
• https://crates.io/crates/pingora-core · Note
• https://twitter.com/vulert_official/status/2029843384605782213 · Twitter Post
• https://t.me/CVEtracker/46389 · Telegram Post