7.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-4366

CVE-2025-4366: Pingora Request Smuggling and Cache Poisoning

Pingora versions prior to 0.5.0 which used the caching functionality in pingora-proxy did not properly drain the downstream request body on cache hits.

This allows an attacker to craft malicious HTTP/1.1 requests which could lead to request smuggling or cache poisoning.

This flaw was corrected in commit fda3317ec822678564d641e7cf1c9b77ee3759ff by ensuring that the downstream request body is always drained before a connection can be reused.

See the blog post for more information.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-4366

CVE-2025-4366:

7.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pingora-core	rust	< 0.5.0	0.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is due to Pingora not properly draining the downstream request body on cache hits before reusing a connection, specifically for HTTP/1.1. This can lead to request smuggling or cache poisoning. The provided commit fda3317ec822678564d641e7cf1c9b77ee3759ff directly addresses this by ensuring the request body is always drained.

The analysis of the commit diff reveals the core of the fix lies within the pingora_core::protocols::http::v1::server::HttpSession::reuse method. Prior to the patch, this method, when determining a connection was keep-alive and reusable, would return the underlying stream (Some(self.underlying_stream)) without explicitly draining any remaining request body. The patch modifies this behavior by adding a call to self.drain_request_body().await? before returning the stream for reuse in such cases. This ensures that any unread portion of the previous request's body is consumed, mitigating the risk of it being prepended to a subsequent request on the same connection.

Therefore, the function pingora_core::protocols::http::v1::server::HttpSession::reuse is identified as the vulnerable function. Its vulnerability was not an incorrect action but an omission – the failure to ensure the request body was drained before allowing connection reuse. This omission created the conditions for request smuggling when Pingora's caching mechanism (in pingora-proxy) served a response early and attempted to reuse the client connection.

Other functions related to body draining (like Session::drain_request_body, and the newly added HttpSession::drain_request_body and HttpSession::do_drain_request_body) were either refactored or introduced as part of the fix mechanism, but the reuse function was the critical point where the draining logic was missing and needed to be enforced.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.