Pingora's Smuggling Fixes: Securing Your Proxy

Deconstructing Pingora's Smuggling Vulnerabilities

The Cloudflare blog post effectively details three distinct HTTP/1.x request smuggling vulnerabilities (CVE-2026-2833, CVE-2026-2835, CVE-2026-2836) discovered in the Pingora open-source framework when used as an ingress proxy. The article excels at explaining the technical intricacies of each vulnerability, from premature upgrades without a 101 handshake to the nuanced interplay of HTTP/1.0, close-delimiting, and transfer-encoding, and finally, a cache key construction flaw. The explanations are thorough, often referencing RFC specifications, and clearly illustrate how these vulnerabilities can lead to security control bypass, cross-user hijacking, and cache poisoning. The disclosure timeline and the proactive patching by Cloudflare in Pingora 0.8.0 are commendable. The article's strength lies in its transparency and technical depth, making it invaluable for developers and security professionals working with Pingora or similar proxy technologies. The emphasis on why Cloudflare's internal infrastructure was not affected provides crucial context and demonstrates the framework's architecture. However, a minor limitation could be the assumption that all users will immediately understand the implications of non-RFC compliant behavior; further emphasis on the 'why' behind accepting some non-compliance for legacy systems could be beneficial for a broader audience. The article could also benefit from a more detailed discussion on how to effectively test for these vulnerabilities in existing deployments, beyond the provided proof-of-concept descriptions.

Key Points

• Three HTTP/1.x request smuggling vulnerabilities (CVE-2026-2833, CVE-2026-2835, CVE-2026-2836) were found in Pingora OSS when used as an ingress proxy.
• These vulnerabilities could allow attackers to bypass security controls, perform cross-user hijacking, and poison caches.
• The vulnerabilities stem from Pingora's non-RFC compliant interpretations of HTTP/1.x request bodies, particularly concerning Upgrade requests and the handling of Content-Length vs. Transfer-Encoding.
• Cloudflare's internal CDN was not affected due to architectural differences and traffic handling policies.
• Pingora 0.8.0 has been released with fixes, and users are strongly recommended to upgrade.
• A cache key construction vulnerability was also addressed, with the default implementation removed to encourage more secure custom implementations.

---

📖 Source: Fixing request smuggling vulnerabilities in Pingora OSS deployments