What is the CVSS score of CVE-2026-2835?

CVE-2026-2835 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-2835?

Within 24 hours: Inventory all systems running Pingora and assess exposure; implement WAF rules to detect/block HTTP smuggling patterns (CL.TE, TE.CL mismatches); enable verbose HTTP request logging. Within 7 days: Segment Pingora instances behind request validation proxies; establish monitoring for anomalous request patterns; conduct threat assessment of internet-facing deployments. Within 30 days: Evaluate alternative reverse proxies if patch timeline is uncertain; prepare emergency patching procedures; execute full security audit of affected systems.

Pingora CVE-2026-2835

CRITICAL

HTTP Request/Response Smuggling (CWE-444)

2026-03-05 cna@cloudflare.com

GHSA-hj7x-879w-vrp7

Code Injection Pingora Cloudflare

9.1

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious HTTP/1.0 request
Exploit

Exploit improper body parsing in Pingora
Execution

Cause request desynchronization with backend
Impact

Execute unauthorized actions on backend

Vulnerability Assessment

Weakness	CWE CWE-444 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V4 - API and Web Service HTTP request consistency
Exploitation Conditions	Pingora deployed as reverse proxy in front of HTTP/1.0-accepting backends with default HTTP request parsing enabled. No authentication required. Vulnerable to remote unauthenticated attackers over network.
Impact	CVSS 9.1.
Exploit ScenarioDerived	Smuggle via TE handling.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

HTTP request smuggling in Pingora HTTP/1.0 Transfer-Encoding handling.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:06 CVSS 9.1

Second HTTP smuggling in Pingora.

RemediationAI

Update.

Affected Packages

cargo pingora-core fix: 0.8.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in cargo

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-444.

Know when Pingora gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 05, 2026 - 00:15 nvd

CRITICAL 9.1

DescriptionCVE.org

An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora’s request framing from backend servers’.

Impact

This vulnerability primarily affects standalone Pingora deployments in front of certain backends that accept HTTP/1.0 requests. An attacker could craft a malicious payload following this request that Pingora forwards to the backend in order to:

Bypass proxy-level ACL controls and WAF logic
Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests
Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP

Cloudflare's CDN infrastructure was not affected by this vulnerability, as its ingress proxy layers forwarded HTTP/1.1 requests only, rejected ambiguous framing such as invalid Content-Length values, and forwarded a single Transfer-Encoding: chunked header for chunked requests.

Mitigation:

Pingora users should upgrade to Pingora v0.8.0 or higher that fixes this issue by correctly parsing message length headers per RFC 9112 and strictly adhering to more RFC guidelines, including that HTTP request bodies are never close-delimited.

As a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact “chunked” string match.

Executive ViewAI

Why It Matters

A critical HTTP Request Smuggling vulnerability in Pingora could allow attackers to bypass security controls, inject malicious requests, or compromise application integrity without detection. Organizations running affected Pingora versions face immediate risk of unauthorized access, data exfiltration, and service disruption until mitigation measures are implemented.

Business Impact: Severe

Compensating Controls

Deploy WAF with rules blocking conflicting Content-Length and Transfer-Encoding headers; normalize HTTP/1.0 requests to HTTP/1.1 with explicit content length; implement strict request validation at ingress layer; isolate Pingora instances to internal-only access where possible; enable request normalization and sanitization; establish real-time monitoring for HTTP desynchronization attack signatures; consider temporary disabling of Transfer-Encoding support if operationally feasible; place Pingora behind verified secure reverse proxy with request smuggling protections.

Threat Intelligence Overview

EPSS Score

0.1%

Top 80% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.