23 matches found
CVE-2026-105299
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...
CVE-2026-105299 Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...
CVE-2026-105299 Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...
CVE-2026-105299 Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...
CVE-2026-105299
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...
EUVD-2026-104781
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...
CVE-2026-105299
Versions of pingora-proxy before 0.9.0 are vulnerable to an ACL bypass because the HTTP/1 upstream path fails to remove client-nominated Connection headers and associated hop-by-hop headers, violating RFC 9110. An attacker can nominate a header that the application subsequently adds in upstream_r...
PT-2026-118096
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream request filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110...
Cloudflare Pingora security vulnerabilities
Cloudflare Pingora versions prior to 0.9.0 have security vulnerabilities. This vulnerability stems from the HTTP/1 upstream path of pingora-proxy, which does not remove the client’s Connection header, other hop headers, and the Connection header specified during the writing of downstream requests...
EUVD-2026-9510
Pingora vulnerable to HTTP Request Smuggling via Premature Upgrade...
Duplicate Advisory: HTTP Request Smuggling via Premature Upgrade
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xq2h-p299-vjwv. This link is maintained to preserve external references. Original Description An HTTP request smuggling vulnerability CWE-444 was found in Pingora's handling of HTTP/1.1 connection upgrades. The...
GHSA-F9V3-J2M7-4HPG Duplicate Advisory: HTTP Request Smuggling via Premature Upgrade
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xq2h-p299-vjwv. This link is maintained to preserve external references. Original Description An HTTP request smuggling vulnerability CWE-444 was found in Pingora's handling of HTTP/1.1 connection upgrades. The...
CVE-2026-2836
A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP cache key implementation generates cache keys using only the URI path, excluding critical factors such as the host header authority...
CVE-2026-2836 Cache poisoning via insecure-by-default cache key
A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP cache key implementation generates cache keys using only the URI path, excluding critical factors such as the host header authority...
CVE-2026-2833
An HTTP request smuggling vulnerability CWE-444 was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a request containing an Upgrade header, causing the proxy to pass through the rest of the bytes on the connection to a backend before the...
EUVD-2025-16165
Malicious code in bioql PyPI...
Pingora proxy server Code Execution
The vulnerability of the Pingora proxy server is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2025-4366
A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning. Fixed in: ...
CVE-2025-4366 Request Smuggling Vulnerability in Pingora
A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning. Fixed in: ...
CVE-2025-4366
A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning. Fixed in: ...