How severe is CVE-2025-4366?

CVE-2025-4366 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-4366 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-4366?

CVE-2025-4366 affects Cloudflare Pingora. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-4366?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-4366 have an EU (EUVD) identifier?

Yes. CVE-2025-4366 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-16165.

When was CVE-2025-4366 published?

CVE-2025-4366 was published on 2025-05-22 and last updated on 2026-06-17.

CVE-2025-4366

CVE-2025-4366 is a medium-severity vulnerability in Cloudflare Pingora with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-444.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
CVSS v4: 7.4
EPSS exploit prediction: 0% (34th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-16165
Weakness: CWE-444
Affected product: Cloudflare Pingora
Published: 2025-05-22
Last modified: 2026-06-17

Description

A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning. Fixed in: https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff Impact: The issue could lead to request smuggling in cases where Pingora’s proxying framework, pingora-proxy, is used for caching allowing an attacker to manipulate headers and URLs in subsequent requests made on the same HTTP/1.1 connection.

Frequently asked questions

What is CVE-2025-4366?: A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning. Fixed in: https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff Impact: The issue could lead to request smuggling in cases where Pingora’s proxying framework, pingora-proxy, is used for caching allowing an attacker to manipulate headers and URLs in subsequent requests made on the same HTTP/1.1 connection.
How severe is CVE-2025-4366?: CVE-2025-4366 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-4366 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-4366?: CVE-2025-4366 affects Cloudflare Pingora. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-4366?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-4366 have an EU (EUVD) identifier?: Yes. CVE-2025-4366 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-16165.
When was CVE-2025-4366 published?: CVE-2025-4366 was published on 2025-05-22 and last updated on 2026-06-17.

References

https://github.com/cloudflare/pingora

Affected products (1)

cpe:2.3:a:cloudflare:pingora:*:*:*:*:*:*:*:*

More vulnerabilities in Cloudflare Pingora

CVE-2026-2835 — Critical (CVSS 9.1): An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding…
CVE-2026-2833 — Critical (CVSS 9.1): An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The…
CVE-2026-2836 — High (CVSS 8.1): A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction.…

All CVEs affecting Cloudflare Pingora →

Other CWE-444 (HTTP Request/Response Smuggling) vulnerabilities

CVE-2025-1867 — Critical (CVSS 10.0): Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows…
CVE-2022-22536 — Critical (CVSS 10.0): SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53…
CVE-2018-3907 — Critical (CVSS 10.0): An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub…
CVE-2025-55315 — Critical (CVSS 9.9): Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized…
CVE-2020-15049 — Critical (CVSS 9.9): An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request…
CVE-2026-13763 — Critical (CVSS 9.8): Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote…

Browse all CWE-444 (HTTP Request/Response Smuggling) vulnerabilities →