crates.io/pingora-core CVE-2026-2835: critical, EPSS 0.82%

Pingora has HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

Action: Upgrade pingora-core to 0.8.0 or later.

cargo update -p pingora-core --precise 0.8.0

Affected

Fixed versions

Sources

• osv: GHSA-hj7x-879w-vrp7
• https://github.com/cloudflare/pingora/security/advisories/GHSA-hj7x-879w-vrp7
• https://nvd.nist.gov/vuln/detail/CVE-2026-2835
• https://github.com/cloudflare/pingora
• https://rustsec.org/advisories/RUSTSEC-2026-0034.html

CVE-2026-2835 · published 2026-03-05T20:56:20Z · modified 2026-03-09T21:01:23.088829Z · JSON