Fixing request smuggling vulnerabilities in Pingora OSS deployments
Mar 9, 2026Edward Wang, Fei Deng, Andrew Hauck
Summary
This post details the identification and patching of three HTTP/1.x request smuggling vulnerabilities (CVE-2026-2833, CVE-2026-2835, CVE-2026-2836) in the Pingora open source framework. It explains how these vulnerabilities could allow attackers to bypass security controls, desync requests, and poison caches in standalone Pingora deployments. The post outlines specific fixes for premature upgrade handling without a 101 handshake and for misinterpretations of HTTP/1.0, close-delimiting, and transfer-encoding, emphasizing that Cloudflare's CDN was not affected due to architectural differences and internal traffic handling practices.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack