« Volver al listado

CVE-2026-2835

Estado: AnalizadaCrítica (9.3)—

An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora’s request framing from backend servers’.

Impact

This vulnerability primarily affects standalone Pingora deployments in front of certain backends that accept HTTP/1.0 requests. An attacker could craft a malicious payload following this request that Pingora forwards to the backend in order to:

Leer descripción completaMostrar menos

Cloudflare's CDN infrastructure was not affected by this vulnerability, as its ingress proxy layers forwarded HTTP/1.1 requests only, rejected ambiguous framing such as invalid Content-Length values, and forwarded a single Transfer-Encoding: chunked header for chunked requests.

Mitigation:

Pingora users should upgrade to Pingora v0.8.0 or higher that fixes this issue by correctly parsing message length headers per RFC 9112 and strictly adhering to more RFC guidelines, including that HTTP request bodies are never close-delimited.

As a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact “chunked” string match.

Detalles técnicos trazas, registros y código del informe original
  *  Bypass proxy-level ACL controls and WAF logic

  *  Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests

  *  Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

HTTP Request Smuggling (CWE-444) en proxy remoto sin autenticación permite bypass de controles, envenenamiento de caché y secuestro de sesiones. Acceso red sin privilegios (AV:N/PR:N/UI:N) → T1190. Impactos: desincronización de tráfico hacia backend (T1090 SSRF/proxy), inyección de respuestas a usua

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficNetwork SegmentationNetwork Intrusion PreventionLimit Access to Resource Over NetworkVulnerability ScanningUser Training

Tecnologías afectadas (1)

Cloudflare — Pingora

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-2835",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-2835",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-06T18:24:39.168924Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@cloudflare.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@cloudflare.com",
      "affectedData": [
        {
          "repo": "https://github.com/cloudflare/pingora",
          "vendor": "Cloudflare",
          "product": "https://github.com/cloudflare/pingora",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.8.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-05T00:15:57.860",
  "references": [
    {
      "url": "https://github.com/cloudflare/pingora",
      "tags": [
        "Product"
      ],
      "source": "cna@cloudflare.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@cloudflare.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora’s request framing from backend servers’.\n\nImpact\n\nThis vulnerability primarily affects standalone Pingora deployments in front of certain backends that accept HTTP/1.0 requests. An attacker could craft a malicious payload following this request that Pingora forwards to the backend in order to:\n\n  *  Bypass proxy-level ACL controls and WAF logic\n\n\n\n\n  *  Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests\n\n\n\n\n  *  Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP\n\n\n\n\nCloudflare's CDN infrastructure was not affected by this vulnerability, as its ingress proxy layers forwarded HTTP/1.1 requests only, rejected ambiguous framing such as invalid Content-Length values, and forwarded a single Transfer-Encoding: chunked header for chunked requests.\n\n\nMitigation:\n\nPingora users should upgrade to Pingora v0.8.0 or higher that fixes this issue by correctly parsing message length headers per RFC 9112 and strictly adhering to more RFC guidelines, including that HTTP request bodies are never close-delimited.\n\nAs a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact “chunked” string match."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de contrabando de solicitudes HTTP (CWE-444) ha sido encontrada en el análisis de Pingora de solicitudes HTTP/1.0 y Transfer-Encoding. El problema ocurre debido a permitir incorrectamente que los cuerpos de solicitudes HTTP/1.0 sean delimitados por cierre y al manejo incorrecto de múltiples valores de Transfer-Encoding, permitiendo a los atacantes enviar solicitudes HTTP/1.0 de una manera que desincronizaría el encuadre de solicitudes de Pingora con el de los servidores backend.\n\nImpacto\n\nEsta vulnerabilidad afecta principalmente a implementaciones de Pingora independientes frente a ciertos backends que aceptan solicitudes HTTP/1.0. Un atacante podría crear una carga útil maliciosa siguiendo esta solicitud que Pingora reenvía al backend con el fin de:\n\n  *  Omitir los controles ACL a nivel de proxy y la lógica WAF\n\n  *  Envenenar cachés y conexiones ascendentes, causando que solicitudes posteriores de usuarios legítimos reciban respuestas destinadas a solicitudes de contrabando\n\n  *  Realizar ataques entre usuarios secuestrando sesiones o contrabandeando solicitudes que parecen originarse de la IP del proxy de confianza\n\nLa infraestructura CDN de Cloudflare no se vio afectada por esta vulnerabilidad, ya que sus capas de proxy de entrada solo reenviaban solicitudes HTTP/1.1, rechazaban el encuadre ambiguo, como valores Content-Length inválidos, y reenviaban un único encabezado Transfer-Encoding: chunked para solicitudes chunked.\n\nMitigación:\n\nLos usuarios de Pingora deberían actualizar a Pingora v0.8.0 o superior que corrige este problema analizando correctamente los encabezados de longitud de mensaje según RFC 9112 y adhiriéndose estrictamente a más directrices de RFC, incluyendo que los cuerpos de solicitudes HTTP nunca son delimitados por cierre.\n\nComo solución alternativa, los usuarios pueden rechazar ciertas solicitudes con un error en la lógica del filtro de solicitudes con el fin de detener el procesamiento de bytes en la conexión y deshabilitar la reutilización de la conexión descendente. El usuario debería rechazar cualquier solicitud que no sea HTTP/1.1, o una solicitud que tenga Content-Length inválido, múltiples encabezados Transfer-Encoding, o un encabezado Transfer-Encoding que no sea una coincidencia exacta de la cadena 'chunked'."
    }
  ],
  "lastModified": "2026-06-17T10:31:51.477",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cloudflare:pingora:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FD8B659-5061-46DA-8A73-2E17D6298546",
              "versionEndExcluding": "0.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@cloudflare.com"
}