{"answers":{"affected":"3 open source packages ship an affected version, including pingora-cache. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-2836 in the wild and no public exploit code.","fix":"Upgrade pingora-cache to 0.8.0 or later.","what":"CVE-2026-2836 is a high-severity vulnerability in https://github.com/cloudflare/pingora, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-2836 and fix it if it is affected.\n\nWhat it is: CVE-2026-2836 is a high-severity vulnerability in https://github.com/cloudflare/pingora, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-2836 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- pingora-cache (crates.io): affected all versions; fixed in 0.8.0\n- pingora-cache (crates.io): affected all versions; fixed in 0.8.0\n- pingora-cache (crates.io): affected from 0.0.0-0; fixed in 0.8.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-2836/ (Markdown: https://insights.sbomify.com/CVE-2026-2836/index.md)","id":"CVE-2026-2836","markdown":"https://insights.sbomify.com/CVE-2026-2836/index.md","name":"CVE-2026-2836","record":{"aliases":["GHSA-f93w-pcj3-rggc","RUSTSEC-2026-0035"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Rust HTTP proxy library","requires_auth":"none","summary":"Attackers can poison cache entries to leak cross-tenant data or serve malicious content due to insecure default cache key generation in Pingora.","user_interaction":"required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"cloudflare","cpe":[{"product":"pingora","vendor":"cloudflare"}],"cvss":{"score":8.4,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N","version":"4.0"},"cwes":[{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity"}],"description":"A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP cache key implementation generates cache keys using only the URI path, excluding critical factors such as the host header (authority). Operators relying on the default are vulnerable to cache poisoning, and cross-origin responses may be improperly served to users.\n\nImpact\n\nThis vulnerability affects users of Pingora's alpha proxy caching feature who relied on the default CacheKey implementation. An attacker could exploit this for:\n\n  *  Cross-tenant data leakage: In multi-tenant deployments, poison the cache so that users from one tenant receive cached responses from another tenant\n\n  *  Cache poisoning attacks: Serve malicious content to legitimate users by poisoning shared cache entries\n\nCloudflare's CDN infrastructure was not affected by this vulnerability, as Cloudflare's default cache key implementation uses multiple factors to prevent cache key poisoning and never made use of the previously provided default.\n\nMitigation:\n\nWe strongly recommend Pingora users to upgrade to Pingora v0.8.0 or higher, which removes the insecure default cache key implementation. Users must now explicitly implement their own callback that includes appropriate factors such as Host header, origin server HTTP scheme, and other attributes their cache should vary on.\n\nPingora users on previous versions may also remove any of their default CacheKey usage and implement their own that should at minimum include the host header / authority and upstream peer’s HTTP scheme.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Cache poisoning via insecure-by-default cache key","id":"CVE-2026-2836","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":3,"n_references":1,"next":{"headline":"Ricerca – advanced search \u003c= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings","id":"CVE-2026-2837"},"packages":[{"ecosystem":"crates.io","fixed":["0.8.0"],"introduced":["0"],"last_affected":[],"package":"pingora-cache","purl":null,"source":"GHSA-f93w-pcj3-rggc"},{"ecosystem":"crates.io","fixed":["0.8.0"],"introduced":["0"],"last_affected":[],"package":"pingora-cache","purl":"pkg:cargo/pingora-cache","source":"GHSA-f93w-pcj3-rggc"},{"ecosystem":"crates.io","fixed":["0.8.0"],"introduced":["0.0.0-0"],"last_affected":[],"package":"pingora-cache","purl":"pkg:cargo/pingora-cache","source":"RUSTSEC-2026-0035"}],"prev":{"headline":"HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing","id":"CVE-2026-2835"},"products":["https://github.com/cloudflare/pingora"],"published":"2026-03-04","related":[{"cvss_score":9.3,"headline":"HTTP Request Smuggling via Premature Upgrade","id":"CVE-2026-2833","kev_date_added":null,"published":"2026-03-04"},{"cvss_score":9.3,"headline":"HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing","id":"CVE-2026-2835","kev_date_added":null,"published":"2026-03-04"},{"cvss_score":7.4,"headline":"Request Smuggling Vulnerability in Pingora","id":"CVE-2025-4366","kev_date_added":null,"published":"2025-05-22"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-03-06","vendors":["Cloudflare"]},"summary":"Attackers can poison cache entries to leak cross-tenant data or serve malicious content due to insecure default cache key generation in Pingora.","url":"https://insights.sbomify.com/CVE-2026-2836/"}