{"id":163792,"date":"2026-03-10T23:11:57","date_gmt":"2026-03-10T21:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy"},"modified":"2026-03-10T23:11:57","modified_gmt":"2026-03-10T21:11:59","slug":"uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","title":{"rendered":"Zranitelnosti v projektu Pingora, kter\u00e9 umo\u017e\u0148uj\u00ed vlo\u017een\u00ed do extern\u00edch po\u017eadavk\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spole\u010dnost Cloudflare ozn\u00e1mila odstran\u011bn\u00ed t\u0159\u00ed zranitelnost\u00ed ve frameworku Pingora, dv\u011b z nich maj\u00ed kritickou \u00farove\u0148 nebezpe\u010dnosti (9.3 z 10). Framework Pingora je naps\u00e1n v jazyce Rust a slou\u017e\u00ed k v\u00fdvoji bezpe\u010dn\u00fdch vysoce v\u00fdkonn\u00fdch s\u00ed\u0165ov\u00fdch slu\u017eeb. Proxy postaven\u00e1 pomoc\u00ed Pingora se pou\u017e\u00edv\u00e1 v s\u00edti pro doru\u010dov\u00e1n\u00ed obsahu Cloudflare a zpracov\u00e1v\u00e1 v\u00edce ne\u017e 40 milion\u016f po\u017eadavk\u016f za sekundu. Zranitelnosti byly odstran\u011bny ve verzi Pingora 0.8.0. <\/p>\n

Dv\u011b nejnebezpe\u010dn\u011bj\u0161\u00ed zranitelnosti umo\u017e\u0148uj\u00ed prov\u00e1d\u011bn\u00ed \u00fatok\u016f typu \u201eHTTP Request Smuggling\u201c, kter\u00e9 umo\u017e\u0148uj\u00ed obch\u00e1zen\u00ed syst\u00e9m\u016f omezen\u00ed p\u0159\u00edstupu a vkl\u00e1d\u00e1n\u00ed do obsahu po\u017eadavk\u016f jin\u00fdch u\u017eivatel\u016f, zpracov\u00e1van\u00fdch ve stejn\u00e9m proudu mezi frontendem a backendem (nap\u0159\u00edklad pro vlo\u017een\u00ed \u0161kodliv\u00e9ho JavaScriptov\u00e9ho k\u00f3du do relace jin\u00e9ho u\u017eivatele na webu). Probl\u00e9my byly odhaleny \u00fa\u010dastn\u00edkem programu Bug Bounty, kter\u00fd vypl\u00e1c\u00ed odm\u011bny za zji\u0161t\u011bn\u00ed zranitelnost\u00ed. <\/p>\n

Ve sch\u00e9matu s p\u0159\u00edstupem k backendu prost\u0159ednictv\u00edm reverzn\u00edho proxy serveru p\u0159ij\u00edm\u00e1 po\u017eadavky klient\u016f dal\u0161\u00ed uzel, kter\u00fd navazuje dlouhodob\u00e9 TCP spojen\u00ed s backendem, kter\u00fd prov\u00e1d\u00ed p\u0159\u00edm\u00e9 zpracov\u00e1n\u00ed po\u017eadavk\u016f. Skrze toto spole\u010dn\u00e9 spojen\u00ed se obvykle p\u0159en\u00e1\u0161ej\u00ed po\u017eadavky r\u016fzn\u00fdch u\u017eivatel\u016f, kter\u00e9 n\u00e1sleduj\u00ed jeden za druh\u00fdm s odd\u011blen\u00edm pomoc\u00ed prost\u0159edk\u016f protokolu HTTP. \u00datoky typu HTTP Request Smuggling vznikaj\u00ed z rozd\u00edln\u00e9ho v\u00fdkladu HTTP hlavi\u010dek a specifikac\u00ed protokolu HTTP na frontendech a backendech, nap\u0159\u00edklad kdy\u017e frontend pou\u017e\u00edv\u00e1 pro ur\u010den\u00ed velikosti po\u017eadavku HTTP hlavi\u010dku \u201eContent-Length\u201c, zat\u00edmco backend \u201eTransfer-Encoding: chunked.\u201c <\/p>\n

Prvn\u00ed zranitelnost CVE-2026-2835 je p\u0159\u00edtomna v k\u00f3du pro anal\u00fdzu po\u017eadavk\u016f HTTP\/1.0 a vznik\u00e1 z nespr\u00e1vn\u00e9ho zpracov\u00e1n\u00ed hlavi\u010dky \u201eTransfer-Encoding\u201c s v\u00edce hodnotami, stejn\u011b jako z pou\u017e\u00edv\u00e1n\u00ed uzav\u0159en\u00ed spojen\u00ed jako indik\u00e1toru konce t\u011bla po\u017eadavku (close-delimited). Pingora kontroloval pouze variantu \u201eTransfer-Encoding: chunked\u201c a ignoroval tuto hlavi\u010dku, pokud obsahovala v\u00edce hodnot. V t\u00e9to situaci Pingora nezohled\u0148oval velikost v hlavi\u010dce \u201eContent-Length\u201c, ale pova\u017eoval za t\u011blo po\u017eadavku v\u0161echna data, z\u00edskan\u00e1 do uzav\u0159en\u00ed spojen\u00ed. <\/p>\n

Zad\u00e1n\u00edm v\u00edce hodnot do hlavi\u010dky \u201eTransfer-Encoding\u201c mohl \u00fato\u010dn\u00edk vytvo\u0159it podm\u00ednky, za kter\u00fdch byl na backend p\u0159esm\u011brov\u00e1n po\u017eadavek, jeho\u017e skute\u010dn\u00e1 velikost neodpov\u00eddala velikosti chunked-\u0159et\u011bzce, vypo\u010d\u00edtan\u00e9mu na z\u00e1klad\u011b hlavi\u010dky \u201eTransfer-Encoding.\u201c Pingora sm\u011broval v\u0161echna p\u0159ijat\u00e1 data jako jeden po\u017eadavek, a backend, jako nap\u0159\u00edklad Node.js, vypo\u010d\u00edt\u00e1val po\u017eadavek na z\u00e1klad\u011b \u201eTransfer-Encoding: chunked\u201c a zbytek zpracov\u00e1val jako za\u010d\u00e1tek dal\u0161\u00edho po\u017eadavku. GET \/ HTTP\/1.0 Host: example.com Connection: keep-alive Transfer-Encoding: identity, chunked Content-Length: 29 0 GET \/admin HTTP\/1.1 X:

\"Zranitelnosti<\/center> <\/p>\n

Druh\u00e1 zranitelnost CVE-2026-2833 je zp\u016fsobena nespr\u00e1vn\u00fdm zpracov\u00e1n\u00edm HTTP hlavi\u010dky «Upgrade» v po\u017eadavc\u00edch HTTP\/1.1. Pokud byl v po\u017eadavku p\u0159\u00edtomen hlavi\u010dka «Upgrade», proxy ihned p\u0159edala k backendu a dal\u0161\u00ed data po\u017eadavku n\u00e1sleduj\u00edc\u00ed za hlavi\u010dkou «Upgrade», ani\u017e by \u010dekala na odpov\u011b\u010f backendu s k\u00f3dem 101 (Switching Protocols). To vedlo k naru\u0161en\u00ed synchronizace toku mezi proxy a backendem, p\u0159i\u010dem\u017e backend vn\u00edmal zaslan\u00e1 data n\u00e1sleduj\u00edc\u00ed po hlavi\u010dce «Upgrade» jako samostatn\u00fd po\u017eadavek a pos\u00edlal v\u00fdsledek proveden\u00ed tohoto po\u017eadavku jako odpov\u011b\u010f na n\u00e1sledn\u00fd po\u017eadavek jin\u00e9ho u\u017eivatele. GET \/ HTTP\/1.1 Host: example.com Upgrade: foo GET \/admin HTTP\/1.1 Host: example.com

\"Zranitelnosti<\/center>
\"Zranitelnosti<\/center> <\/p>\n

Probl\u00e9my se projevuj\u00ed p\u0159i pou\u017e\u00edv\u00e1n\u00ed Pingory ve form\u011b zp\u011btn\u00e9ho proxy (ingress proxy), kter\u00e1 p\u0159en\u00e1\u0161\u00ed po\u017eadavky u\u017eivatel\u016f k backend\u016fm pomoc\u00ed protokol\u016f HTTP\/1.0 nebo HTTP\/1.1. Pou\u017e\u00edvan\u00e1 konfigurace Pingory v s\u00edti dod\u00e1n\u00ed obsahu Cloudflare neumo\u017enila zneu\u017e\u00edt zranitelnosti, proto\u017ee Pingora v CDN nen\u00ed pou\u017e\u00edv\u00e1na jako ingress proxy, p\u0159esm\u011brov\u00e1v\u00e1 po\u017eadavky pouze pomoc\u00ed protokolu HTTP\/1.1, blokuje po\u017eadavky s nespr\u00e1vn\u00fdmi hodnotami Content-Length, p\u0159esm\u011brov\u00e1v\u00e1 pouze jednu hodnotu hlavi\u010dky «Transfer-Encoding: chunked» a do po\u017eadavk\u016f s hlavi\u010dkou «Upgrade:» vkl\u00e1d\u00e1 dodate\u010dnou hlavi\u010dku «Connection: close», kter\u00e1 neumo\u017e\u0148uje pos\u00edlat dal\u0161\u00ed po\u017eadavky ve stejn\u00e9m spojen\u00ed. <\/p>\n

T\u0159et\u00ed zranitelnost CVE-2026-2836 (stupe\u0148 nebezpe\u010dnosti 8.4 z 10) vede k po\u0161kozen\u00ed cache (cache poisoning) kv\u016fli generaci kl\u00ed\u010de um\u00edst\u011bn\u00ed dat v cache (CacheKey) pouze na z\u00e1klad\u011b cesty z URI, ignoruj\u00edc\u00ed obsah hlavi\u010dky «Host». Takov\u00e9 nedostatky vedou k vytv\u00e1\u0159en\u00ed stejn\u00fdch ke\u0161ovac\u00edch kl\u00ed\u010d\u016f pro stejn\u00e9 HTTP cesty k r\u016fzn\u00fdm hostitel\u016fm. Zranitelnost m\u016f\u017ee b\u00fdt vyu\u017eita k substituci obsahu cache p\u0159i pou\u017eit\u00ed re\u017eimu ke\u0161ov\u00e1n\u00ed pro v\u00edce hostitel\u016f. V Pingore je ke\u0161ov\u00e1n\u00ed experiment\u00e1ln\u00ed funkc\u00ed, kter\u00e1 nen\u00ed doporu\u010dena pro produk\u010dn\u00ed nasazen\u00ed.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10). \u0424\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a Pingora \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432. \u041f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Pingora \u043f\u0440\u043e\u043a\u0441\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Cloudflare \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 40 \u043c\u043b\u043d \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 \u0441\u0435\u043a\u0443\u043d\u0434\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":163793,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-163792","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnosti v projektu Pingora, kter\u00e9 umo\u017e\u0148uj\u00ed infiltraci do extern\u00edch po\u017eadavk\u016f | ProHoster","description":"Spole\u010dnost Cloudflare ozn\u00e1mila odstran\u011bn\u00ed t\u0159\u00ed zranitelnost\u00ed ve frameworku Pingora, z nich\u017e dv\u011b byly ozna\u010deny jako kritick\u00e9 (9,3 z 10).","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0435 Pingora, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u043a\u043b\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10).","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-10T21:11:59+00:00","article:modified_time":"2026-03-10T21:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/163792","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=163792"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/163792\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/163793"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=163792"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=163792"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=163792"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}