Fixing request smuggling vulnerabilities in Pingora OSS deployments

What this post added

This post details the identification and patching of three HTTP/1.x request smuggling vulnerabilities (CVE-2026-2833, CVE-2026-2835, CVE-2026-2836) in the Pingora open source framework. It explains how these vulnerabilities could allow attackers to bypass security controls, desync requests, and poison caches in standalone Pingora deployments. The post outlines specific fixes for premature upgrade handling without a 101 handshake and for misinterpretations of HTTP/1.0, close-delimiting, and transfer-encoding, emphasizing that Cloudflare's CDN was not affected due to architectural differences and internal traffic handling practices.