CVE-2026-2835

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2835", "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "state": "PUBLISHED", "assignerShortName": "cloudflare", "dateReserved": "2026-02-19T21:24:24.726Z", "datePublished": "2026-03-04T23:32:41.186Z", "dateUpdated": "2026-03-06T18:24:48.150Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "https://github.com/cloudflare/pingora", "repo": "https://github.com/cloudflare/pingora", "vendor": "Cloudflare", "versions": [{"lessThan": "0.8.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Rajat Raghav (xclow3n)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: transparent;\">An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora\u2019s request framing from backend servers\u2019.</span><b><span style=\"background-color: transparent;\"><br></span></b><br><p><span style=\"background-color: transparent;\">Impact</span></p><p><span style=\"background-color: transparent;\">This vulnerability primarily affects standalone Pingora deployments in front of certain backends that accept HTTP/1.0 requests. An attacker could craft a malicious payload following this request that Pingora forwards to the backend in order to:</span></p><ul><li><p><span style=\"background-color: transparent;\">Bypass proxy-level ACL controls and WAF logic</span></p></li></ul><ul><li><p><span style=\"background-color: transparent;\">Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests</span></p></li></ul><ul><li><p><span style=\"background-color: transparent;\">Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP</span></p></li></ul><p><span style=\"background-color: transparent;\">Cloudflare's CDN infrastructure was not affected by this vulnerability, as its ingress proxy layers forwarded HTTP/1.1 requests only, rejected ambiguous framing such as invalid Content-Length values, and forwarded a single Transfer-Encoding: chunked header for chunked requests.</span></p><br><p><span style=\"background-color: transparent;\">Mitigation:</span></p><p><span style=\"background-color: transparent;\">Pingora users should upgrade to Pingora v0.8.0 or higher that fixes this issue by correctly parsing message length headers per RFC 9112 and strictly adhering to more RFC guidelines, including that HTTP request bodies are never close-delimited.</span></p><p><span style=\"background-color: transparent;\">As a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact \u201cchunked\u201d string match.</span></p><br><br>"}], "value": "An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora\u2019s request framing from backend servers\u2019.\n\nImpact\n\nThis vulnerability primarily affects standalone Pingora deployments in front of certain backends that accept HTTP/1.0 requests. An attacker could craft a malicious payload following this request that Pingora forwards to the backend in order to:\n\n * Bypass proxy-level ACL controls and WAF logic\n\n\n\n\n * Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests\n\n\n\n\n * Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP\n\n\n\n\nCloudflare's CDN infrastructure was not affected by this vulnerability, as its ingress proxy layers forwarded HTTP/1.1 requests only, rejected ambiguous framing such as invalid Content-Length values, and forwarded a single Transfer-Encoding: chunked header for chunked requests.\n\n\nMitigation:\n\nPingora users should upgrade to Pingora v0.8.0 or higher that fixes this issue by correctly parsing message length headers per RFC 9112 and strictly adhering to more RFC guidelines, including that HTTP request bodies are never close-delimited.\n\nAs a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact \u201cchunked\u201d string match."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "shortName": "cloudflare", "dateUpdated": "2026-03-04T23:32:41.186Z"}, "references": [{"url": "https://github.com/cloudflare/pingora"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Pingora users should upgrade to Pingora v0.8.0 or higher<br>"}], "value": "Pingora users should upgrade to Pingora v0.8.0 or higher"}], "source": {"discovery": "UNKNOWN"}, "title": "HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><span style=\"background-color: transparent;\">As a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact \u201cchunked\u201d string match.</span></p><br>"}], "value": "As a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact \u201cchunked\u201d string match."}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T18:24:39.168924Z", "id": "CVE-2026-2835", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:24:48.150Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2835", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T18:24:39.168924Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:24:43.100Z"}}], "cna": {"title": "HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Rajat Raghav (xclow3n)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/cloudflare/pingora", "vendor": "Cloudflare", "product": "https://github.com/cloudflare/pingora", "versions": [{"status": "affected", "version": "0", "lessThan": "0.8.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Pingora users should upgrade to Pingora v0.8.0 or higher", "supportingMedia": [{"type": "text/html", "value": "Pingora users should upgrade to Pingora v0.8.0 or higher<br>", "base64": false}]}], "references": [{"url": "https://github.com/cloudflare/pingora"}], "workarounds": [{"lang": "en", "value": "As a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact \u201cchunked\u201d string match.", "supportingMedia": [{"type": "text/html", "value": "<p><span style=\"background-color: transparent;\">As a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact \u201cchunked\u201d string match.</span></p><br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora\u2019s request framing from backend servers\u2019.\n\nImpact\n\nThis vulnerability primarily affects standalone Pingora deployments in front of certain backends that accept HTTP/1.0 requests. An attacker could craft a malicious payload following this request that Pingora forwards to the backend in order to:\n\n * Bypass proxy-level ACL controls and WAF logic\n\n\n\n\n * Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests\n\n\n\n\n * Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP\n\n\n\n\nCloudflare's CDN infrastructure was not affected by this vulnerability, as its ingress proxy layers forwarded HTTP/1.1 requests only, rejected ambiguous framing such as invalid Content-Length values, and forwarded a single Transfer-Encoding: chunked header for chunked requests.\n\n\nMitigation:\n\nPingora users should upgrade to Pingora v0.8.0 or higher that fixes this issue by correctly parsing message length headers per RFC 9112 and strictly adhering to more RFC guidelines, including that HTTP request bodies are never close-delimited.\n\nAs a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact \u201cchunked\u201d string match.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora\u2019s request framing from backend servers\u2019.</span><b><span style=\"background-color: transparent;\"><br></span></b><br><p><span style=\"background-color: transparent;\">Impact</span></p><p><span style=\"background-color: transparent;\">This vulnerability primarily affects standalone Pingora deployments in front of certain backends that accept HTTP/1.0 requests. An attacker could craft a malicious payload following this request that Pingora forwards to the backend in order to:</span></p><ul><li><p><span style=\"background-color: transparent;\">Bypass proxy-level ACL controls and WAF logic</span></p></li></ul><ul><li><p><span style=\"background-color: transparent;\">Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests</span></p></li></ul><ul><li><p><span style=\"background-color: transparent;\">Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP</span></p></li></ul><p><span style=\"background-color: transparent;\">Cloudflare's CDN infrastructure was not affected by this vulnerability, as its ingress proxy layers forwarded HTTP/1.1 requests only, rejected ambiguous framing such as invalid Content-Length values, and forwarded a single Transfer-Encoding: chunked header for chunked requests.</span></p><br><p><span style=\"background-color: transparent;\">Mitigation:</span></p><p><span style=\"background-color: transparent;\">Pingora users should upgrade to Pingora v0.8.0 or higher that fixes this issue by correctly parsing message length headers per RFC 9112 and strictly adhering to more RFC guidelines, including that HTTP request bodies are never close-delimited.</span></p><p><span style=\"background-color: transparent;\">As a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact \u201cchunked\u201d string match.</span></p><br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "shortName": "cloudflare", "dateUpdated": "2026-03-04T23:32:41.186Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2835", "state": "PUBLISHED", "dateUpdated": "2026-03-06T18:24:48.150Z", "dateReserved": "2026-02-19T21:24:24.726Z", "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "datePublished": "2026-03-04T23:32:41.186Z", "assignerShortName": "cloudflare"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "https://github.com/cloudflare/pingora", "repo": "https://github.com/cloudflare/pingora", "vendor": "Cloudflare", "versions": [{"lessThan": "0.8.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cna@cloudflare.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cloudflare:pingora:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FD8B659-5061-46DA-8A73-2E17D6298546", "versionEndExcluding": "0.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora\u2019s request framing from backend servers\u2019.\n\nImpact\n\nThis vulnerability primarily affects standalone Pingora deployments in front of certain backends that accept HTTP/1.0 requests. An attacker could craft a malicious payload following this request that Pingora forwards to the backend in order to:\n\n * Bypass proxy-level ACL controls and WAF logic\n\n\n\n\n * Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests\n\n\n\n\n * Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP\n\n\n\n\nCloudflare's CDN infrastructure was not affected by this vulnerability, as its ingress proxy layers forwarded HTTP/1.1 requests only, rejected ambiguous framing such as invalid Content-Length values, and forwarded a single Transfer-Encoding: chunked header for chunked requests.\n\n\nMitigation:\n\nPingora users should upgrade to Pingora v0.8.0 or higher that fixes this issue by correctly parsing message length headers per RFC 9112 and strictly adhering to more RFC guidelines, including that HTTP request bodies are never close-delimited.\n\nAs a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact \u201cchunked\u201d string match."}, {"lang": "es", "value": "Una vulnerabilidad de contrabando de solicitudes HTTP (CWE-444) ha sido encontrada en el an\u00e1lisis de Pingora de solicitudes HTTP/1.0 y Transfer-Encoding. El problema ocurre debido a permitir incorrectamente que los cuerpos de solicitudes HTTP/1.0 sean delimitados por cierre y al manejo incorrecto de m\u00faltiples valores de Transfer-Encoding, permitiendo a los atacantes enviar solicitudes HTTP/1.0 de una manera que desincronizar\u00eda el encuadre de solicitudes de Pingora con el de los servidores backend.\n\nImpacto\n\nEsta vulnerabilidad afecta principalmente a implementaciones de Pingora independientes frente a ciertos backends que aceptan solicitudes HTTP/1.0. Un atacante podr\u00eda crear una carga \u00fatil maliciosa siguiendo esta solicitud que Pingora reenv\u00eda al backend con el fin de:\n\n * Omitir los controles ACL a nivel de proxy y la l\u00f3gica WAF\n\n * Envenenar cach\u00e9s y conexiones ascendentes, causando que solicitudes posteriores de usuarios leg\u00edtimos reciban respuestas destinadas a solicitudes de contrabando\n\n * Realizar ataques entre usuarios secuestrando sesiones o contrabandeando solicitudes que parecen originarse de la IP del proxy de confianza\n\nLa infraestructura CDN de Cloudflare no se vio afectada por esta vulnerabilidad, ya que sus capas de proxy de entrada solo reenviaban solicitudes HTTP/1.1, rechazaban el encuadre ambiguo, como valores Content-Length inv\u00e1lidos, y reenviaban un \u00fanico encabezado Transfer-Encoding: chunked para solicitudes chunked.\n\nMitigaci\u00f3n:\n\nLos usuarios de Pingora deber\u00edan actualizar a Pingora v0.8.0 o superior que corrige este problema analizando correctamente los encabezados de longitud de mensaje seg\u00fan RFC 9112 y adhiri\u00e9ndose estrictamente a m\u00e1s directrices de RFC, incluyendo que los cuerpos de solicitudes HTTP nunca son delimitados por cierre.\n\nComo soluci\u00f3n alternativa, los usuarios pueden rechazar ciertas solicitudes con un error en la l\u00f3gica del filtro de solicitudes con el fin de detener el procesamiento de bytes en la conexi\u00f3n y deshabilitar la reutilizaci\u00f3n de la conexi\u00f3n descendente. El usuario deber\u00eda rechazar cualquier solicitud que no sea HTTP/1.1, o una solicitud que tenga Content-Length inv\u00e1lido, m\u00faltiples encabezados Transfer-Encoding, o un encabezado Transfer-Encoding que no sea una coincidencia exacta de la cadena 'chunked'."}], "id": "CVE-2026-2835", "lastModified": "2026-06-17T10:31:51.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@cloudflare.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2835", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T18:24:39.168924Z", "version": "2.0.3"}}]}, "published": "2026-03-05T00:15:57.860", "references": [{"source": "cna@cloudflare.com", "tags": ["Product"], "url": "https://github.com/cloudflare/pingora"}], "sourceIdentifier": "cna@cloudflare.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "cna@cloudflare.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,0.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "https://github.com/cloudflare/pingora", "source": "cna", "vendor": "Cloudflare"}, "product": "pingora", "vendor": "cloudflare"}], "analysis": {"en": {"generated_at": "2026-04-17T13:00:08.905170+00:00", "value": {"mitigation_remediation": ["Upgrade Pingora to v0.8.0 or later, which corrects request parsing according to RFC 9112 and enforces strict Transfer\u2011Encoding handling.", "If upgrading is not immediately possible, configure the request filter to reject any non\u2011HTTP/1.1 request, any request with an invalid Content\u2011Length header, any request carrying multiple Transfer\u2011Encoding headers, or any Transfer\u2011Encoding header that is not exactly \"chunked\".", "Disable downstream connection reuse to prevent poisoned connections from affecting subsequent legitimate requests."], "summary": {"action": "Immediate Patch", "impact": "HTTP Request Smuggling Bypass"}, "threat_synthesis": {"affected_systems": "The flaw affects standalone Pingora instances deployed in front of backends that accept HTTP/1.0 requests. Cloudflare\u2019s own CDN ingress layers were not affected because they exposed only HTTP/1.1 traffic and rejected ambiguous framing. Attackers would require direct access to a vulnerable Pingora deployment or to a backend that accepts HTTP/1.0.", "description_and_impact": "An HTTP Request Smuggling vulnerability (CWE-444) exists in Pingora's handling of HTTP/1.0 requests and Transfer\u2011Encoding headers. By exploiting the parser\u2019s acceptance of close\u2011delimited HTTP/1.0 bodies and its improper treatment of multiple Transfer\u2011Encoding values, an attacker can craft requests that desynchronize Pingora\u2019s framing from the backend. This flaw allows the attacker to bypass proxy\u2011level ACLs and WAF logic, poison upstream caches and connections, and perform cross\u2011user attacks that misuse the trusted proxy IP to hijack sessions or inject requests that appear to originate from the proxy. The impact is a compromise of confidentiality, integrity, and availability of the backends serviced by Pingora.", "risk_and_exploitability": "The vulnerability carries a CVSS base score of 9.3, indicating critical severity. The EPSS score is reported as less than 1%, suggesting a low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Nevertheless, the attack vector is remote and straightforward: an attacker sends a crafted HTTP/1.0 or multi\u2011Transfer\u2011Encoding request to the Pingora proxy. If the proxy forwards the request, the attacker can bypass controls, cache poisoning, or session hijacking, depending on the backend configuration."}}}}, "created": "2026-03-05T09:05:31.218358+00:00", "updated": "2026-04-17T13:00:12.034483+00:00", "vendors": ["cloudflare", "cloudflare$PRODUCT$pingora"]}