HTTP/1 Vulnerability in Pingora Proxy by Cloudflare

CVE-2026-105299

What is CVE-2026-105299?

Before version 0.9.0, the Pingora Proxy failed to properly strip the Connection header and other hop-by-hop headers when processing HTTP/1 upstream paths. This oversight allows a remote attacker to manipulate headers, leading to potential unauthorized access to resources. Specifically, an intermediary that processes Connection nominations can remove critical headers like X-Forwarded-For, potentially bypassing IP-based authorization mechanisms at the origin. The issue primarily affects deployments where an HTTP/1 intermediary is trusted by the origin to interpret added headers. Upgrading to version 0.9.0 or later is recommended to mitigate this risk, as it ensures the appropriate removal of sensitive headers.

References