GitHub Advisoryadvisory · crates.io

GHSA-93c7-7xqw-w357 Pingora has a Request Smuggling Vulnerability

HIGH Published 2025-06-20 Modified 2025-06-20 Official page ↗
Aliases
CVE-2025-4366
Ecosystem
crates.io
Packages
pingora-core
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-444
Reviewed
2025-06-20

Affected packages

• crates.io pingora-core: < 0.5.0 → fixed in 0.5.0

Description

A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning. Fixed in https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff Impact The issue could lead to request smuggling in cases where Pingora’s proxying framework, pingora-proxy, is used for caching allowing an attacker to manipulate headers and URLs in subsequent requests made on the same HTTP/1.1 connection.

Related

Alias · CVE (1)

  • CVE-2025-4366 A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be… vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References