Vulnerabilities

TI-2026-02436 CVE-2026-2836 · GHSA-f93w-pcj3-rggc

Cache poisoning via insecure-by-default cache key

LOW 37

A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction.

CVSS 4.0HIGH 8.4 Network No auth User interaction EPSS 0.00396 Published 2026-03-04 Fixed in 0.8.0 CWE-345

TI-2026-02435 CVE-2026-2835 · GHSA-hj7x-879w-vrp7

MEDIUM 47

An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00793 Published 2026-03-04 Fixed in 0.8.0 CWE-444

TI-2026-02433 CVE-2026-2833 · GHSA-xq2h-p299-vjwv

MEDIUM 47

An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00669 Published 2026-03-04 Fixed in 0.8.0 CWE-444