Cloudflare disclosed three HTTP/1.x request smuggling vulnerabilities (CVE-2026-2833, CVE-2026-2835, CVE-2026-2836) in the open-source Pingora proxy framework, patched in Pingora 0.8.0. The vulnerabilities affected standalone Pingora ingress deployments and could enable attackers to bypass proxy security controls, perform cross-user session hijacking, and poison caches. Three attack vectors are detailed: premature Upgrade header passthrough, improper Transfer-Encoding/HTTP 1.0 framing, and a default CacheKey construction flaw that ignored host headers. Cloudflare's own CDN was not affected due to architectural differences. Users of the Pingora framework are strongly urged to upgrade to 0.8.0 immediately.
Table of contents
What was the vulnerability?RecommendationDisclosure and response timelineAcknowledgementsSort: