CVE-2025-4366: cloudflare pingora HTTP Request/Response Smuggling

Vulnerability summary

CVE-2025-4366 is a high (CVSS 7.4) HTTP Request/Response Smuggling vulnerability in cloudflare pingora. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44% of scored vulnerabilities.

Timeline

1. 22-05-2025
   PublishedVulnerability first disclosed.
2. 18-06-2025
   Last modifiedVulnerability information updated.

Description

A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning. Fixed in:  https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff Impact: The issue could lead to request smuggling in cases where Pingora’s proxying framework, pingora-proxy, is used for caching allowing an attacker to manipulate headers and URLs in subsequent requests made on the same HTTP/1.1 connection.

• CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.