Skip to content
OpenAdvisories

Product · Cloudflare

https://github.com/cloudflare/pingora

6 known vulnerabilities.

All Critical High Medium Low Exploited only

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-2835

    HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

    An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Tran…

    Cloudflare https://github.com/cloudflare/pingora pingora-core crates.io
  • Critical 9.3
    CVE-2026-2833

    HTTP Request Smuggling via Premature Upgrade

    An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a request containing an Upgrade header, causing the proxy to pass through the rest of the bytes on t…

    Cloudflare https://github.com/cloudflare/pingora pingora-core crates.io