CVE-2026-2835

{"id": "CVE-2026-2835", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@cloudflare.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-05T00:15:57.860", "references": [{"url": "https://github.com/cloudflare/pingora", "tags": ["Product"], "source": "cna@cloudflare.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@cloudflare.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora\u2019s request framing from backend servers\u2019.\n\nImpact\n\nThis vulnerability primarily affects standalone Pingora deployments in front of certain backends that accept HTTP/1.0 requests. An attacker could craft a malicious payload following this request that Pingora forwards to the backend in order to:\n\n * Bypass proxy-level ACL controls and WAF logic\n\n\n\n\n * Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests\n\n\n\n\n * Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP\n\n\n\n\nCloudflare's CDN infrastructure was not affected by this vulnerability, as its ingress proxy layers forwarded HTTP/1.1 requests only, rejected ambiguous framing such as invalid Content-Length values, and forwarded a single Transfer-Encoding: chunked header for chunked requests.\n\n\nMitigation:\n\nPingora users should upgrade to Pingora v0.8.0 or higher that fixes this issue by correctly parsing message length headers per RFC 9112 and strictly adhering to more RFC guidelines, including that HTTP request bodies are never close-delimited.\n\nAs a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact \u201cchunked\u201d string match."}, {"lang": "es", "value": "Una vulnerabilidad de contrabando de solicitudes HTTP (CWE-444) ha sido encontrada en el an\u00e1lisis de Pingora de solicitudes HTTP/1.0 y Transfer-Encoding. El problema ocurre debido a permitir incorrectamente que los cuerpos de solicitudes HTTP/1.0 sean delimitados por cierre y al manejo incorrecto de m\u00faltiples valores de Transfer-Encoding, permitiendo a los atacantes enviar solicitudes HTTP/1.0 de una manera que desincronizar\u00eda el encuadre de solicitudes de Pingora con el de los servidores backend.\n\nImpacto\n\nEsta vulnerabilidad afecta principalmente a implementaciones de Pingora independientes frente a ciertos backends que aceptan solicitudes HTTP/1.0. Un atacante podr\u00eda crear una carga \u00fatil maliciosa siguiendo esta solicitud que Pingora reenv\u00eda al backend con el fin de:\n\n * Omitir los controles ACL a nivel de proxy y la l\u00f3gica WAF\n\n * Envenenar cach\u00e9s y conexiones ascendentes, causando que solicitudes posteriores de usuarios leg\u00edtimos reciban respuestas destinadas a solicitudes de contrabando\n\n * Realizar ataques entre usuarios secuestrando sesiones o contrabandeando solicitudes que parecen originarse de la IP del proxy de confianza\n\nLa infraestructura CDN de Cloudflare no se vio afectada por esta vulnerabilidad, ya que sus capas de proxy de entrada solo reenviaban solicitudes HTTP/1.1, rechazaban el encuadre ambiguo, como valores Content-Length inv\u00e1lidos, y reenviaban un \u00fanico encabezado Transfer-Encoding: chunked para solicitudes chunked.\n\nMitigaci\u00f3n:\n\nLos usuarios de Pingora deber\u00edan actualizar a Pingora v0.8.0 o superior que corrige este problema analizando correctamente los encabezados de longitud de mensaje seg\u00fan RFC 9112 y adhiri\u00e9ndose estrictamente a m\u00e1s directrices de RFC, incluyendo que los cuerpos de solicitudes HTTP nunca son delimitados por cierre.\n\nComo soluci\u00f3n alternativa, los usuarios pueden rechazar ciertas solicitudes con un error en la l\u00f3gica del filtro de solicitudes con el fin de detener el procesamiento de bytes en la conexi\u00f3n y deshabilitar la reutilizaci\u00f3n de la conexi\u00f3n descendente. El usuario deber\u00eda rechazar cualquier solicitud que no sea HTTP/1.1, o una solicitud que tenga Content-Length inv\u00e1lido, m\u00faltiples encabezados Transfer-Encoding, o un encabezado Transfer-Encoding que no sea una coincidencia exacta de la cadena 'chunked'."}], "lastModified": "2026-03-12T15:06:16.957", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cloudflare:pingora:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FD8B659-5061-46DA-8A73-2E17D6298546", "versionEndExcluding": "0.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@cloudflare.com"}