CVE-2025-4366: Request Smuggling Vulnerability in Pingora
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-93c7-7xqw-w357. This link is maintained to preserve external references.
Original Description
Pingora versions prior to 0.5.0 which used the caching functionality in pingora-proxy did not properly drain the downstream request body on cache hits.
This allows an attacker to craft malicious HTTP/1.1 requests which could lead to request smuggling or cache poisoning.
This flaw was corrected in commit fda3317ec822678564d641e7cf1c9b77ee3759ff by ensuring that the downstream request body is always drained before a connection can be reused.
See the blog post for more information.
Other sources
A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning.
Fixed in https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff
Impact The issue could lead to request smuggling in cases where Pingora’s proxying framework, pingora-proxy, is used for caching allowing an attacker to manipulate headers and URLs in subsequent requests made on the same HTTP/1.1 connection.
— GitHub
A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning.
Fixed in: https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff
Impact: The issue could lead to request smuggling in cases where Pingora’s proxying framework, pingora-proxy, is used for caching allowing an attacker to manipulate headers and URLs in subsequent requests made on the same HTTP/1.1 connection.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4366?
CVE-2025-4366 is classified as a significant security vulnerability due to its potential for unauthorized request execution and cache poisoning.
How do I fix CVE-2025-4366?
To resolve CVE-2025-4366, you should upgrade to the latest version of the Cloudflare pingora-proxy that addresses this vulnerability.
What are the potential impacts of CVE-2025-4366?
CVE-2025-4366 can lead to unauthorized execution of malicious HTTP requests and result in cache poisoning.
What kind of application is affected by CVE-2025-4366?
CVE-2025-4366 affects the Cloudflare pingora-proxy proxying framework.
When was CVE-2025-4366 reported?
CVE-2025-4366 was reported as a vulnerability in the relevant security timelines established by cybersecurity resources.