Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cloudflare/pingora

              main @ 09696b5
            

Fixes

CVEs

HIGH

Peak severity

38.5%

Coverage

Highlights

HTTP Request Smuggling: 5 prior fixes. Scrutinize any change in this area.

pingora-core/src/connectors/tls/rustls/mod.rs: most-fixed (3 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Request Smuggling: Multiple fixes target H2 request acceptance and forwarding to H1 upstreams, indicating persistent smuggling vectors via header mismatches and control bytes.

Request Smuggling: Hop-by-hop and Connection-nominated header handling required a configurable sanitization policy, showing the default path was permissive and prone to header injection.

Request Smuggling: Client-side serialization lacked validation of request targets and response framing, enabling smuggling via delimiter bytes and ambiguous Content-Length/Transfer-Encoding.