HTTP Request Smuggling Vulnerability in Pingora Proxy by Cloudflare
CVE-2026-2833

9.3CRITICAL

Key Information:

Vendor

Cloudflare

Status
Https://github.com/cloudflare/pingora
Vendor
CVE Published:
4 March 2026

What is CVE-2026-2833?

A vulnerability was identified in the Pingora proxy used by Cloudflare, specifically linked to HTTP/1.1 connection upgrades. This flaw allows an attacker to exploit requests that include an Upgrade header, enabling them to manipulate the connection to forward a malicious payload before the backend server has acknowledged the upgrade. Such exploitation can lead to serious consequences, including the circumvention of proxy-level security measures and the hijacking of user sessions. Affected users are advised to upgrade to Pingora v0.8.0 or higher to mitigate the risks associated with this vulnerability.

Affected Version(s)

https://github.com/cloudflare/pingora 0 < 0.8.0

References

https://github.com/cloudflare/pingora

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rajat Raghav (xclow3n)
.