Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Cloudflare Component: Pingora Clear all filters
TI-2026-02436 CVE-2026-2836 · GHSA-f93w-pcj3-rggc

Cache poisoning via insecure-by-default cache key

Priority LOW 37

A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction.

CVSS 4.0HIGH 8.4 Network No auth User interaction EPSS 0.00396 Published 2026-03-04 Fixed in 0.8.0 CWE-345
TI-2026-02433 CVE-2026-2833 · GHSA-xq2h-p299-vjwv

HTTP Request Smuggling via Premature Upgrade

Priority MEDIUM 47

An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00669 Published 2026-03-04 Fixed in 0.8.0 CWE-444
TI-2025-03894 CVE-2025-4366 · GHSA-93c7-7xqw-w357

Request Smuggling Vulnerability in Pingora

Priority LOW 33

A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request…

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.00536 Published 2025-05-22 Fixed in 0.5.0 CWE-444