HTTP Request Smuggling via Premature Upgrade

CVE-2026-2833 is an HTTP request smuggling vulnerability (CWE-444) in Pingora's handling of HTTP/1.1 connection upgrades. The root cause is that Pingora proxies immediately forward bytes following a request with an Upgrade header to the backend without waiting for a 101 Switching Protocols response [1][4]. This premature forwarding enables an attacker to smuggle a malicious payload that the backend interprets as a subsequent request header, bypassing proxy-level security controls.

To exploit this vulnerability, an attacker needs network access to a standalone Pingora proxy exposed to external traffic. The attack requires no authentication and can be performed with a crafted HTTP request containing an Upgrade header followed by the smuggled payload. The vulnerability is present in Pingora versions prior to 0.8.0 [2]. Cloudflare's CDN infrastructure is not affected due to proper HTTP parsing boundaries [1][4].

Successful exploitation can lead to bypassing proxy-level ACL controls and web application firewall (WAF) logic, poisoning caches and upstream connections, and performing cross-user attacks such as session hijacking. Smuggled requests appear to originate from the trusted proxy IP, enabling further attacks against backend services [1][4].

The vulnerability is fixed in Pingora v0.8.0, which only switches connection modes after receiving a 101 Switching Protocols response from the backend [4]. As a workaround, users can return an error on requests containing an Upgrade header in their request filter logic to stop processing bytes beyond the header and disable downstream connection reuse [1][4].