RUSTSEC-2025-0037 Pingora Request Smuggling and Cache Poisoning

Pingora versions prior to 0.5.0 which used the caching functionality in pingora-proxy did not properly drain the downstream request body on cache hits. This allows an attacker to craft malicious HTTP/1.1 requests which could lead to request smuggling or cache poisoning. This flaw was corrected in...

Pingora Request Smuggling and Cache Poisoning

Pingora versions prior to 0.5.0 which used the caching functionality in pingora-proxy did not properly drain the downstream request body on cache hits. This allows an attacker to craft malicious HTTP/1.1 requests which could lead to request smuggling or cache poisoning. This flaw was corrected in...

Pingora 安全漏洞

Pingora is a Cloudflare open source library for building fast, reliable and evolvable web services. A security vulnerability exists in Pingora that stems from request smuggling and could lead to unauthorized request execution and cache poisoning...

PT-2025-22502 · Cloudflare · Pingora

Name of the Vulnerable Software and Affected Versions: Pingora versions prior to the fixed version Description: A request smuggling issue was identified in Pingora's proxying framework, pingora-proxy, allowing malicious HTTP requests to be injected via manipulated request bodies on cache HITs. Th...

Cloudflare Public Bug Bounty: Origin IP address disclosure through Pingora response header

HTTP responses to cached files served by the Pingora proxy revealed Origin IP address information. An attacker could trigger this misbehaviour by crafting a request with a malformed Range header. The attack was successful under conditions where Cloudflare cache was in REVALIDATED state, the...