CVE-2026-2835 identifies a critical HTTP Request Smuggling vulnerability in Cloudflare's Pingora HTTP parser, specifically in its handling of HTTP/1.0 requests and Transfer-Encoding headers. The root cause is Pingora's incorrect allowance of HTTP/1.0 request bodies to be close-delimited and improper parsing of multiple Transfer-Encoding values. This leads to a desynchronization between Pingora's request framing and that of backend servers, enabling attackers to inject crafted HTTP/1.0 requests that are interpreted differently by Pingora and the backend. Such desync can be exploited to bypass proxy-level access control lists (ACLs) and Web Application Firewall (WAF) protections, poison caches and upstream connections causing legitimate users to receive malicious responses, and perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP address. The vulnerability primarily impacts standalone Pingora deployments placed in front of backends that accept HTTP/1.0 requests. Cloudflare’s own CDN infrastructure is unaffected due to its strict enforcement of HTTP/1.1 requests, rejection of ambiguous framing, and limitation to a single Transfer-Encoding: chunked header. The vulnerability has been assigned a CVSS 4.0 score of 9.3, reflecting its critical severity with network attack vector, no required privileges or user interaction, and high impact on integrity and availability. Mitigation involves upgrading to Pingora version 0.8.0 or later, which fixes the issue by adhering strictly to RFC 9112 guidelines, including disallowing close-delimited HTTP request bodies and correctly parsing message length headers. As a temporary workaround, users can implement request filtering to reject non-HTTP/1.1 requests, requests with invalid Content-Length headers, multiple Transfer-Encoding headers, or Transfer-Encoding headers not exactly matching “chunked”. No public exploits have been reported to date.

The impact of CVE-2026-2835 is significant for organizations using standalone Pingora deployments in front of backend servers that accept HTTP/1.0 requests. Successful exploitation allows attackers to bypass critical security controls such as proxy ACLs and WAFs, undermining perimeter defenses. Cache poisoning and upstream connection poisoning can lead to widespread delivery of malicious or unauthorized content to legitimate users, potentially causing data leakage, session hijacking, or unauthorized actions performed on behalf of users. Cross-user attacks facilitated by request smuggling can compromise session integrity and confidentiality, leading to unauthorized access and data breaches. The desynchronization can also disrupt service availability by confusing backend servers with malformed requests. Although Cloudflare’s CDN infrastructure is not affected, organizations deploying Pingora independently or in hybrid environments face elevated risk. The vulnerability’s critical CVSS score reflects the ease of exploitation over the network without authentication or user interaction, combined with high impact on integrity and availability. This could lead to severe operational disruptions, data compromise, and erosion of trust in affected services.

To mitigate CVE-2026-2835, organizations should immediately upgrade Pingora to version 0.8.0 or later, which implements RFC 9112-compliant HTTP parsing and disallows close-delimited HTTP/1.0 request bodies. This upgrade is the definitive fix and should be prioritized in all environments using Pingora. As an interim measure, implement strict request filtering to reject any HTTP requests that are not HTTP/1.1, have invalid or ambiguous Content-Length headers, contain multiple Transfer-Encoding headers, or have Transfer-Encoding values other than an exact “chunked” string. Disabling downstream connection reuse can also reduce the risk of request smuggling attacks. Additionally, review backend server configurations to minimize acceptance of HTTP/1.0 requests where possible, and monitor logs for anomalous request patterns indicative of smuggling attempts. Network-level protections such as rate limiting and anomaly detection can help identify exploitation attempts. Finally, ensure that all proxy and backend components are updated and configured to handle HTTP requests consistently to prevent desynchronization.