Pingora vulnerabilities
3 known vulnerabilities in Pingora from Cloudflare. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
https://github.com/cloudflare/pingora: Insufficient Verification of Data Authenticity
A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP cache key implementation generates cache keys using only the URI path, excluding critical factors suc
- 9.1 Critical severity
https://github.com/cloudflare/pingora: Inconsistent Interpretation of HTTP Requests
An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Trans
- 9.1 Critical severity
https://github.com/cloudflare/pingora: Inconsistent Interpretation of HTTP Requests
An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a request containing an Upgrade header, causing the proxy to pass through the rest of the bytes on th