CVE-2025-4366 Request Smuggling Vulnerability in Pingora

What is CVE-2025-4366?

CVE-2025-4366 is a high-severity vulnerability in cloudflare:pingora, published on 22 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning.

Fixed in:  https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff

Impact: The issue could lead to request smuggling in cases where Pingora’s proxying framework, pingora-proxy, is used for caching allowing an attacker to manipulate headers and URLs in subsequent requests made on the same HTTP/1.1 connection.

Weakness: CWE-444

Which versions are affected by CVE-2025-4366?

3 open source packages ship an affected version, including pingora-core. It affects 1 product.

Products include Cloudflare Pingora.

How do I fix CVE-2025-4366?

Upgrade pingora-core to 0.5.0 or later.

Is CVE-2025-4366 being exploited?

There is no known exploitation of CVE-2025-4366 in the wild and no public exploit code.

Other vulnerabilities in cloudflare:pingora

• CVE-2026-2833 HTTP Request Smuggling via Premature Upgrade Critical 9.3
• CVE-2026-2835 HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing Critical 9.3
• CVE-2026-2836 Cache poisoning via insecure-by-default cache key High 8.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-93c7-7xqw-w357, RUSTSEC-2025-0037.