Resolving a request smuggling vulnerability in Pingora

This post details the discovery and mitigation of an HTTP/1.1 request smuggling vulnerability in the Pingora OSS framework, specifically within its caching component. The vulnerability arose from a parsing bug where, on a cache hit, unread request bodies could be misinterpreted as the start of a subsequent request, leading to potential request hijacking and cache poisoning. Cloudflare mitigated this by disabling traffic to vulnerable components, releasing a patch (Pingora 0.5.0+), and invalidating cached assets.