Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to…
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Section 7.6.1 requires intermediaries to remove them. The HTTP/2 upstream path already removed Connection and related HTTP/1-specific headers. A client could therefore nominate a header that the application adds in upstream_request_filter (for example, Connection: keep-alive, X-Forwarded-For). A downstr
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- GitHub
- Product
- github
- CVSS
- 8.7
Why it ranks 10 (Routine)
- CVSS 8.7 high
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.