studio/proxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(deps): upgrade pingora 0.7→0.8 and aws-lc-sys to patch CVEs

Browse Source 
- pingora* 0.7.0 → 0.8.0: fixes CVE-2026-2833 (HTTP request smuggling
  via premature connection closure, CRITICAL)
- aws-lc-sys 0.37.1 → 0.38.0: fixes GHSA-65p9-r9h6-22vj (timing
  side-channel in AES-CCM tag verification, HIGH)

Signed-off-by: Sienna Meridian Satterwhite <sienna@sunbeam.pt>
This commit is contained in:
Sienna Meridian Satterwhite
2026-03-10 23:38:19 +00:00
parent e5b6802107
commit 41cf6ccc49
2 changed files with 94 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
Cargo.toml
View File

@@ -9,10 +9,10 @@ path = "src/lib.rs"
[dependencies]
# Pingora with rustls backend (pure Rust TLS, no BoringSSL C build)
pingora = { version = "0.7", features = ["rustls"] }
pingora-proxy = { version = "0.7", features = ["rustls"] }
pingora-core = { version = "0.7", features = ["rustls"] }
pingora-http = "0.7"
pingora = { version = "0.8", features = ["rustls"] }
pingora-proxy = { version = "0.8", features = ["rustls"] }
pingora-core = { version = "0.8", features = ["rustls"] }
pingora-http = "0.8"
# HTTP header constants
http = "1"