Breaking Pingora HTTP Request Smuggling & Cache Poisoning in...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://xclow3n.github.io/post/6/
• Blog Title: Breaking Pingora: HTTP Request Smuggling & Cache Poisoning in Cloudflare's Reverse Proxy
• Suggested Section: Pentesting Web -> HTTP Request Smuggling / HTTP Desync Attack (add Pingora-specific vectors: premature Upgrade passthrough; TE comma-separated/duplicate TE parsing leading to CL stripping + close-delimited forwarding) and Pentesting Web -> Cache Poisoning and Cache Deception (cache key host/scheme/port omission causing vhost collisions)

🎯 Content Summary

Post focus
The post documents 4 vulnerabilities found and reported in Cloudflare Pingora (Rust reverse-proxy framework) between Dec 2025 and Jan 2026: three HTTP request smuggling issues and one cache poisoning issue. The author states they are exploitable under default Pingora configuration (no special setup, no auth) and that cross-user impact was demonstrated for smuggling using ...

🔧 Technical Details

Premature Upgrade passthrough → request smuggling (CVE-2026-2833): If a proxy switches into raw tunnel/passthrough mode solely upon seeing an Upgrade header (without validating the backend accepted the upgrade via 101 Switching Protocols), an attacker can pipeline a second HTTP request in the same TCP stream. The proxy parses only the first request then forwards subsequent bytes uninspected; the backend parses them as a new request from the proxy’s trusted IP, bypassing proxy ACL/WAF/rate limits/auth and enabling cross-user HTTP desync on keep-alive backends.

TE token/normalization parsing flaws + TE precedence → no framing → HTTP/1.0 close-delimited forwarding (CVE-2026-2835): If a proxy (1) misparses valid comma-separated TE values (e.g., exact-matching chunked so identity, chunked is not recognized) or (2) reads only the first of duplicate Transfer-Encoding headers (uses .get() inste...

🤖 Agent Actions

I’m mapping the relevant sections first, then I’ll read several nearby files to avoid adding duplicate material or picking the wrong page.
I’ve identified the likely targets. Next I’m reading the existing smuggling, desync, and cache-poisoning pages to see whether Pingora’s patterns are already covered and whether the repo expects one combined page or a narrower technique-specific update.
I’ve confirmed the repo already has mature general pages for smuggling and cache poisoning, so the main decision is where one concise Pingora-derived addition will be most reusable without splitting the same technique across files.
I’ve verified the existing pages already cover generic X-Forwarded-Host poisoning and classic TE/CL desyncs, but not the Pingora-specific parsing failures or the “path-only cache key across virtual hosts” footgun. I’m checking the official advisories now so the references section is grounded in primary sources instead of only the blog.
The best single target is src/pentesting-web/http-request-smuggling/README.md: it already carries parser discrepancy variants, desync impacts, and related cache-poisoning consequences, while the Pingora cache-key issue can be framed as a reverse-proxy cache footgun derived from the same audit. I’m inserting one compact section there instead of splitting content across multiple files.
I’m editing the smuggling page now. The addition is limited to three reusable lessons from Pingora: Upgrade-triggered premature passthrough, Transfer-Encoding token normalization mistakes combined with illegal close-delimited request bodies, and path-only cache keys causing cross-vhost poisoning.
The edit is in place. I’m doing a final readback and diff check now to make sure the section lands cleanly, doesn’t duplicate nearby material too heavily, and keeps the references section valid.
Updated README.md with a new section covering:

• premature Upgrade-triggered passthrough as a smuggling primitive
• Transfer-Encoding list / duplicate-header misparsing plus HTTP/1.0 close-delimited fallback
• related reverse-proxy cache poisoning from path-only cache keys that omit Host / scheme / port

I kept the change in a single file, added concise PoCs and audit checks, and appended the blog plus official Pingora advisories to the existing references section. I also reviewed the diff after editing; no additional tests were needed for this markdown-only update.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://xclow3n.github.io/post/6/

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> HTTP Request Smuggling / HTTP Desync Attack (add Pingora-specific vectors: premature Upgrade passthrough; TE comma-separated/duplicate TE parsing leading to CL stripping + close-delimited forwarding) and Pentesting Web -> Cache Poisoning and Cache Deception (cache key host/scheme/port omission causing vhost collisions)".

Repository Maintenance:

• MD Files Formatting: 963 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0