Pingora 0.8.0 Fixes Request Smuggling Vulns

🔑 Enhanced Key Takeaways

• •Vulnerabilities assigned CVE-2025-4366, CVE-2026-2833, and CVE-2026-2835, with CVE-2026-2835 rated critical at CVSS 9.3[1][2][4][6].
• •CVE-2025-4366 caused by failure to drain request body on cache hits, enabling smuggling via undrained buffer on persistent connections[1][3][5].
• •CVE-2026-2833 triggered by premature passthrough of bytes after Upgrade header before backend acceptance, allowing payload smuggling[2][8].
• •CVE-2026-2835 from misparsing HTTP/1.0 close-delimited bodies and multiple Transfer-Encoding headers, desyncing with backends[4][6].
• •Cloudflare's production CDN unaffected due to strict HTTP/1.1 parsing and rejection of ambiguous requests[2][3][4].

🛠️ Technical Deep Dive

• •CVE-2025-4366: On cache hit, pingora-cache serves response without draining full request body per Content-Length, leaving smuggled request (e.g., 'GET / HTTP/1.1\r\nHost: attacker.example.com') in buffer for next request on HTTP/1.1 connection[1][3].
• •CVE-2026-2833: Proxy reads Upgrade header, forwards remaining bytes to backend pre-acceptance, enabling attacker payload interpreted as subsequent request, bypassing WAF/ACL[2].
• •CVE-2026-2835: Allows HTTP/1.0 bodies close-delimited (violates RFC 9112), mishandles multiple Transfer-Encoding headers, causing framing desync with backends accepting HTTP/1.0[4].
• •Fixes in v0.8.0 enforce RFC 9112 message length parsing, drain bodies fully, reject invalid Content-Length/Transfer-Encoding, and handle upgrades correctly[2][3][4].

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline