HackerOne Disclosed Reports - 2026-09-14

High
resolved

HTTP Request Smuggling via Unsanitized Hop-by-Hop Headers

Bug reported by Quan Le was disclosed at September 14, 2026, 4:57 am   |   Improper Access Control - Generic

The vulnerability allowed forwarding of HTTP/1 h2c upgrade requests to upstream servers, bypassing request-level filters applied by the proxy. The issue was addressed in Pingora version 0.9.0, which restricted HTTP/1 upgrades to WebSocket by default.