{"action":"Upgrade pingora-cache to 0.8.0 or later.","affected":[{"fixed":"0.8.0","introduced":"0"}],"component":"pingora-cache","cve_ids":["CVE-2026-2836"],"ecosystem":"crates.io","epss":0.0041,"exploited":false,"fixed_versions":["0.8.0"],"ghsa_id":"GHSA-f93w-pcj3-rggc","id":"tcs_01M5KEXA9RWD7H6XCHZCY05MRK","modified_at":"2026-03-09T21:02:24.914549Z","published_at":"2026-03-05T20:57:49Z","references":["https://osv.dev/vulnerability/GHSA-f93w-pcj3-rggc","https://github.com/cloudflare/pingora/security/advisories/GHSA-f93w-pcj3-rggc","https://nvd.nist.gov/vuln/detail/CVE-2026-2836","https://github.com/cloudflare/pingora","https://rustsec.org/advisories/RUSTSEC-2026-0035.html"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-f93w-pcj3-rggc","url":"https://osv.dev/vulnerability/GHSA-f93w-pcj3-rggc"}],"summary":"Pingora vulnerable to cache poisoning via insecure-by-default cache key"}