{"id":"CVE-2026-105299","aliases":["RUSTSEC-2026-0390","GHSA-vx4q-2c55-cvmg"],"title":"Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments","summary":"Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments","severity":"high","cvss":8.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","vendor":"pingora-proxy","product":"pingora-proxy","ecosystem":"rust","affected":["pingora-proxy >= 0.0.0-0, < 0.9.0"],"patched":["pingora-proxy 0.9.0"],"published":"2026-10-20","updated":"2026-10-26","sourceUpdated":"2026-10-26T11:15:11.361865763Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0390","references":[{"url":"https://crates.io/crates/pingora-proxy"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0390.html"},{"url":"https://github.com/cloudflare/pingora/commit/28c18e6b6b04dd0bd937234e5950049e6d74cded"},{"url":"https://github.com/cloudflare/pingora/commit/ca23f1668eca8e78be7ba62ef0edbd458b40eeee"},{"url":"https://github.com/cloudflare/pingora"}],"tags":["osv","rust","cve.org"],"epss":0.00425,"epssPercentile":0.36596,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-20T19:18:45.445676Z"},"cvssSource":"cna","ingestedAt":"2026-10-20T01:49:42.583Z","slug":"CVE-2026-105299","body":"## Overview\n\nPingora versions prior to 0.9.0 passed the downstream request through `upstream_request_filter` and wrote it to HTTP/1 upstreams without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Section 7.6.1 requires intermediaries to remove them. The HTTP/2 upstream path already removed Connection and related HTTP/1-specific headers. A client could therefore nominate a header that the application adds in `upstream_request_filter` (for example, `Connection: keep-alive, X-Forwarded-For`). A downstream HTTP/1 intermediary that honors Connection would then strip the Pingora-added header before it reached the origin.\n\nThis specifically affects chained deployments where an HTTP/1 intermediary between Pingora and the origin processes Connection nominations (for example, Go's `net/http/httputil.ReverseProxy`) and the origin trusts headers added by that intermediary (for example, X-Forwarded-For for IP-based authorization). A remote, unauthenticated attacker can have those headers removed, potentially bypassing authorization. This is the same class of issue as CVE-2022-31813 in Apache HTTP Server.\n\nThis flaw was corrected in commits 28c18e6b6b04dd0bd937234e5950049e6d74cded and ca23f1668eca8e78be7ba62ef0edbd458b40eeee. By default, Pingora now removes hop-by-hop and Connection-nominated headers from upstream requests, and rejects requests whose Connection header nominates Host, X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, or a pseudo-header. This is controlled by `PeerOptions::http_upstream_request_policy`; `HttpUpstreamRequestPolicy::preserve()` restores the old passthrough behavior and should not be used if the origin relies on headers added by Pingora. Users should upgrade to Pingora >= 0.9.0.\n\nNote: Cloudflare CDN customers were unaffected, as no such chained deployment as described above exists with internal Pingora services, and Connection headers are sanitized before arriving at Pingora gateways.\n\n## Affected packages\n\n- `pingora-proxy >= 0.0.0-0, < 0.9.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pingora-proxy 0.9.0`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}