Pingora HTTP Request Smuggling and Cache

HTTP request smuggling in Pingora HTTP/1.0 Transfer-Encoding handling.

HTTP request smuggling in Cloudflare Pingora HTTP/1.1 upgrade handling.

Pingora's default HTTP cache key implementation excludes the host header when generating cache keys, allowing attackers to poison the cache and serve cross-origin responses to victims. This affects deployments using the default CacheKey implementation in multi-tenant environments, where an attacker could cause users from one tenant to receive cached responses belonging to another tenant. No patch is currently available for this high-severity vulnerability.