https://github.com/cloudflare/pingora vulnerabilities
CVEs whose affected-version data names the https://github.com/cloudflare/pingora package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-105297High· 7.5Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send …
CVE-2026-105298Medium· 6.3Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority…
CVE-2026-105299High· 8.7Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop heade…