Cloudflare Pingora

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Tier 2 open-source row, not the $10,000 production tier) │ $3,500 │ $4,375 High │ $1,500 │ $1,875 Medium │ $750 │ $938 Low │ $250 │ $313 Submit a vulnerability CVE history 5 Last 12 months 7 Lifetime Parsing/validation 35 % Access control 25 % Memory safety 20 % Denial of service 15 % Latest advisories Loading the feed Overview Pingora is the Rust proxy framework Cloudflare wrote to replace nginx in its own edge, and it now carries a large fraction of the traffic crossing that network, more than a trillion requests a day by Cloudflare's own figure at open-sourcing. Since February 2024 it has also become the default answer for anyone building a custom proxy in Rust: it is the foundation of the River reverse-proxy effort and it is embedded in a growing set of commercial CDNs and API gateways, which means a Pingora parsing bug is simultaneously a Cloudflare-edge bug and a downstream-fleet bug. It is the most CVE-active project in its niche over the last year, with CVE-2025-4366 a genuine request-smuggling flaw in the framework. Cloudflare pays it on the Tier 2 open-source row, $250 at Low up to $3,500 for a Critical, and sorona.xyz adds 1.25x on top of whatever Cloudflare awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 10 business days First response 10 business days after first response Triage 10 business days after triage Bounty In scope Cloudflare prices open source as a tier of its own, in the program's words Tier 2 - Open Source (github.com/cloudflare) , covering Cloudflare-published open-source projects on GitHub under that org and capped at $3,500 for a Critical. cloudflare/pingora is covered by both bountied org-wide assets and is absent from the descoped list, so the framework is in scope as a whole HTTP/1.1 and HTTP/2 parsing, framing and serialisation across pingora-http and the protocol layers of pingora-core , on the downstream leg and the upstream leg alike The proxy pipeline in pingora-proxy : the request and response filter phases, and what each phase is allowed to change about a transaction in flight The HTTP cache in pingora-cache , covering cache keys, storage, eviction, purging and the lock that keeps concurrent fills from colliding Connection pooling and upstream connection reuse, which is where cross-request state leaks live in a proxy of this shape Load balancing, service discovery and health checking in pingora-load-balancing , including the hashing that decides which upstream a request reaches The TLS layers in pingora-boringssl and pingora-openssl , covering certificate handling, verification and session behaviour on either side of the proxy The server runtime in pingora-core : listener setup, threading, graceful restart and the zero-downtime upgrade that hands sockets between processes The unsafe Rust and the FFI boundaries throughout, which is where a Rust proxy still gets memory-safety bugs Out of scope Findings only reachable in a bespoke proxy an outside developer wrote on top of the framework, with no Cloudflare-reachable path Denial of service whose cost is merely linear in the size of the input Static-analysis-only reports pointing at unsafe blocks with no runnable reproduction Dependency CVEs in third-party crates without a demonstrated reachable path through Pingora itself Anything in the archived or example crates carried in the repository Denial of service aimed at Cloudflare's production edge, which the program excludes outright Severity cap to plan around: the Tier 2 open-source row tops out at $3,500 for a Critical, since Cloudflare's $10,000 row is bound to production infrastructure rather than the GitHub org Most-valued findings Request smuggling or desync between the downstream and upstream legs, which is the highest-severity class this framework produces and the one with published precedent Cache poisoning or cache-key confusion in pingora-cache that lets an attacker place a response in front of another client Memory-safety violations reachable from network input through the unsafe or FFI surface, demonstrated with a crashing or corrupting input Cross-request state leakage through pooled upstream connections, where one client's headers, body or identity reach another's transaction Header and body parsing flaws that let a request be interpreted differently by Pingora and by the origin behind it Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A working proof of concept is mandatory; a static reading of an unsafe block is not a report Reproduce against your own build of the framework rather than against Cloudflare's production edge Findings only reachable in a third-party proxy built on the framework, with no Cloudflare-reachable path, may be assessed at a lower severity Archived and experimental repositories under the Cloudflare org are generally Informational; Pingora is neither, so say which crate and which version you hit Show impact in a supported or realistic deployment, not just isolated source-level behaviour, which is the policy's standard for open-source reports Program stats 376 Reports resolved $568k Bounties paid 77% Response efficiency Disclosure Coordinated with Cloudflare on a bounded clock: nothing may be published for 90 days from submission without prior written approval. Pingora advisories are being issued on a regular cadence through 2026, so the triage loop that ends in a public CVE is live rather than theoretical, and sorona.xyz holds your finding until that advisory lands or the window closes. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability