Cloudflare Https Github.Com Cloudflare Pingora vulnerabilities

CVE-2026-2833 [CRITICAL] CWE-444 CVE-2026-2833: An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connec An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a request containing an Upgrade header, causing the proxy to pass through the rest of the bytes on the connection to a backend before the backend has accepted the upgrade. An attacker can thus

CVE-2026-2835 [CRITICAL] CWE-444 CVE-2026-2835: An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 an An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desyn

CVE-2022-31813 [CRITICAL] CWE-348 CVE-2022-31813: Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server ba Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.

CVE-2026-2836 [HIGH] CWE-345 CVE-2026-2836: A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache k A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP cache key implementation generates cache keys using only the URI path, excluding critical factors such as the host header (authority). Operators relying on the default are vulnerable to cache pois

CVE-2026-105297 [HIGH] CWE-770 CVE-2026-105297: Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless t Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per

CVE-2026-105298 [MEDIUM] CWE-444 CVE-2026-105298: Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from th Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority value, but the upstream received the client-supplied Host value. Pingora also accepted :authority values containing