Fixing request smuggling vulnerabilities in Pingora OSS deployments

In December 2025, Cloudflare acquired studies of HTTP/1.x request smuggling vulnerabilities within the Pingora open supply framework when Pingora is used to construct an ingress proxy. At the moment we’re discussing how these vulnerabilities work and the way we patched them in Pingora 0.8.0.

The vulnerabilities are CVE-2026-2833, CVE-2026-2835, and CVE-2026-2836. These points have been responsibly reported to us by Rajat Raghav (xclow3n) by our Bug Bounty Program.

Cloudflare’s CDN and buyer site visitors weren’t affected, our investigation discovered. No motion is required for Cloudflare clients, and no affect was detected. 

Because of the structure of Cloudflare’s community, these vulnerabilities couldn’t be exploited: Pingora just isn’t used as an ingress proxy in Cloudflare’s CDN.

Nonetheless, these points affect standalone Pingora deployments uncovered to the Web, and should allow an attacker to:

• Bypass Pingora proxy-layer safety controls

• Desync HTTP request/responses with backends for cross-user hijacking assaults (session or credential theft)

• Poison Pingora proxy-layer caches retrieving content material from shared backends

We have now launched Pingora 0.8.0 with fixes and hardening. Whereas Cloudflare clients weren’t affected, we strongly advocate customers of the Pingora framework to improve as quickly as doable.

The studies described a couple of completely different HTTP/1 assault payloads that might trigger desync assaults. Such requests may trigger the proxy and backend to disagree about the place the request physique ends, permitting a second request to be “smuggled” previous proxy‑layer checks. The researcher offered a proof-of-concept to validate how a primary Pingora reverse proxy misinterpreted request physique lengths and forwarded these requests to server backends resembling Node/Categorical or uvicorn.

Upon receiving the studies, our engineering workforce instantly investigated and validated that, because the reporter additionally confirmed, the Cloudflare CDN itself was not susceptible. Nonetheless, the workforce did additionally validate that vulnerabilities exist when Pingora acts because the ingress proxy to shared backends.

By design, the Pingora framework does enable edge case HTTP requests or responses that aren’t strictly RFC compliant, as a result of we should settle for this form of site visitors for patrons with legacy HTTP stacks. However this leniency has limits to keep away from exposing Cloudflare itself to vulnerabilities.

On this case, Pingora had non-RFC-compliant interpretations of request our bodies inside its HTTP/1 stack that allowed these desync assaults to exist. Pingora deployments inside Cloudflare should not straight uncovered to ingress site visitors, and we discovered that manufacturing site visitors that arrived at Pingora providers weren’t topic to those misinterpretations. Thus, the assaults weren’t exploitable on Cloudflare site visitors itself, not like a earlier Pingora smuggling vulnerability disclosed in Might 2025.

We’ll clarify, case-by-case, how these assault payloads labored.

The primary report confirmed {that a} request with an Improve header worth would trigger Pingora to go by subsequent bytes on the HTTP connection instantly, earlier than the backend had accepted an improve (by returning 101 Switching Protocols). The attacker may thus pipeline a second HTTP request after the improve request on the identical connection:

GET / HTTP/1.1
Host: instance.com
Improve: foo


GET /admin HTTP/1.1
Host: instance.com

Pingora would parse solely the preliminary request, then deal with the remaining buffered bytes because the “upgraded” stream and ahead them on to the backend in a “passthrough” mode because of the Improve header (till the response was acquired).

This isn’t in any respect how the HTTP/1.1 Improve course of per RFC 9110 is meant to work. The next bytes ought to solely be interpreted as a part of an upgraded stream if a 101 Switching Protocols header is acquired, and if a 200 OK response is acquired as a substitute, the next bytes ought to proceed to be interpreted as HTTP.

^{An attacker that sends an Improve request, then pipelines a partial HTTP request might trigger a desync assault. Pingora will incorrectly interpret each as the identical upgraded request, even when the backend server declines the improve with a 200.}

By way of the improper pass-through, a Pingora deployment that acquired a non-101 response may nonetheless ahead the second partial HTTP request to the upstream as-is, bypassing any Pingora person‑outlined ACL-handling or WAF logic, and poison the connection to the upstream so {that a} subsequent request from a unique person may improperly obtain the /admin response.

^{After the assault payload, Pingora and the backend server at the moment are “desynced.” The backend server will wait till it thinks the remainder of the partial /assault request header that Pingora forwarded is full. When Pingora forwards a unique person’s request, the 2 headers are mixed from the backend server’s perspective, and the attacker has now poisoned the opposite person’s response.}

We’ve since patched Pingora to change the interpretation of subsequent bytes solely as soon as the upstream responds with 101 Switching Protocols.

We verified Cloudflare was not affected for 2 causes:

1. The ingress CDN proxies do not need this improper habits.

2. The purchasers to our inner Pingora providers don’t try to pipeline HTTP/1 requests. Moreover, the Pingora service these purchasers discuss straight with disables keep-alive on these Improve requests by injecting a Connection: shut header; this prevents further requests that will be despatched — and subsequently smuggled — over the identical connection.

The reporter additionally demonstrated what appeared to be a extra traditional “CL.TE” desync-type assault, the place the Pingora proxy would use Content material-Size as framing whereas the backend would use Switch-Encoding as framing:

GET / HTTP/1.0
Host: instance.com
Connection: keep-alive
Switch-Encoding: identification, chunked
Content material-Size: 29

0

GET /admin HTTP/1.1
X:

Within the reporter’s instance, Pingora would deal with all subsequent bytes after the primary GET / request header as a part of that request’s physique, however the node.js backend server would interpret the physique as chunked and ending on the zero-length chunk. There are literally a couple of issues occurring right here:

1. Pingora’s chunked encoding recognition was fairly barebones (solely checking for whether or not Switch-Encoding was “chunked”) and assumed that there may solely be one encoding or Switch-Encoding header. However the RFC solely mandates that the closing encoding should be chunked to use chunked framing. So per RFC, this request ought to have a chunked message physique (if it weren’t HTTP/1.0 — extra on that beneath).

2. Pingora was additionally not really utilizing the Content material-Size (as a result of the Switch-Encoding overrode the Content material-Size per RFC). Due to the unrecognized Switch-Encoding and the HTTP/1.0 model, the request physique was as a substitute handled as close-delimited (which signifies that the response physique’s finish is marked by closure of the underlying transport connection). An absence of framing headers would additionally set off the identical misinterpretation on HTTP/1.0. Though response our bodies are allowed to be close-delimited, request our bodies are by no means close-delimited. The truth is, this clarification is now explicitly referred to as out as a separate notice in RFC 9112.

3. That is an HTTP/1.0 request that didn’t outline Switch-Encoding. The RFC mandates that HTTP/1.0 requests containing Switch-Encoding should “treat the message as if the framing is faulty” and shut the connection. Parsers resembling those in nginx and hyper simply reject these requests to keep away from ambiguous framing.

^{When an attacker pipelines a partial HTTP request header after the HTTP/1.0 + Switch-Encoding request, Pingora would incorrectly interpret that partial header as a part of the identical request, fairly than as a definite request. This allows the identical type of desync assault as described within the untimely Improve instance.}

This spoke to a extra elementary misreading of the RFC significantly by way of response vs. request message framing. We’ve since mounted the improper a number of Switch-Encoding parsing, adhere strictly to the request size tips such that HTTP request our bodies can by no means be thought-about close-delimited, and reject invalid Content material-Size and HTTP/1.0 + Switch-Encoding request messages. Additional protections we’ve added embrace rejecting CONNECT requests by default as a result of the HTTP proxy logic doesn’t at the moment deal with CONNECT as particular for the needs of CONNECT improve proxying, and these requests have particular message framing guidelines. (Word that incoming CONNECT requests are rejected by the Cloudflare CDN.)

Once we investigated and instrumented our providers internally, we discovered no requests arriving at our Pingora providers that will have been misinterpreted. We discovered that downstream proxy layers within the CDN would ahead as HTTP/1.1 solely, reject ambiguous framing resembling invalid Content material-Size, and solely ahead a single Switch-Encoding: chunked header for chunked requests.

The researcher additionally reported one different cache poisoning vulnerability relating to default CacheKey development. The naive default implementation factored in solely the URI path (with out different elements resembling host header or upstream server HTTP scheme), which meant completely different hosts utilizing the identical HTTP path may collide and poison one another’s cache.

This could have an effect on customers of the alpha proxy caching characteristic who selected to make use of the default CacheKey implementation. We have now since eliminated that default, as a result of whereas utilizing one thing like HTTP scheme + host + URI is smart for a lot of purposes, we would like customers to watch out when developing their cache keys for themselves. If their proxy logic will conditionally alter the URI or methodology on the upstream request, for instance, that logic seemingly additionally should be factored into the cache key scheme to keep away from poisoning.

Internally, Cloudflare’s default cache key makes use of various elements to stop cache key poisoning, and by no means made use of the beforehand offered default.

In case you use Pingora as a proxy, improve to Pingora 0.8.0 at your earliest comfort.

We apologize for the affect this vulnerability might have had on Pingora customers. As Pingora earns its place as vital Web infrastructure past Cloudflare, we imagine it’s necessary for the framework to advertise use of strict RFC compliance by default and can proceed this effort. Only a few customers of the framework ought to must cope with the identical “wild Internet” that Cloudflare does. Our intention is that stricter adherence to the most recent RFC requirements by default will harden safety for Pingora customers and transfer the Web as a complete towards finest practices.

– 2025‑12‑02: Improve‑primarily based smuggling reported through bug bounty.

– 2026‑01‑13: Switch‑Encoding / HTTP/1.0 parsing points reported.

– 2026-01-18: Default cache key development concern reported.

– 2026‑01‑29 to 2026‑02‑13: Fixes validated with the reporter. Work on extra RFC-compliance checks continues.

– 2026-02-25: Cache key default elimination and extra RFC checks validated with researcher.

– 2026‑03-02: Pingora 0.8.0 launched.

– 2026-03-04: CVE advisories printed.

We thank Rajat Raghav (xclow3n) for the report, detailed reproductions, and verification of the fixes by our bug bounty program. Please see the researcher’s corresponding weblog put up for extra data.

We’d additionally lengthen a heartfelt thanks to the Pingora open supply group for his or her lively engagement, concern studies, and contributions to the framework. You actually assist us construct a greater Web.