Skip to content
OpenAdvisories

Package · crates.io

pingora-proxy

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 8.7
    CVE-2026-105299

    Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments

    Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connec…

    Cloudflare https://github.com/cloudflare/pingora pingora-proxy crates.io