pingora-core

7 results · Feed

• Medium 6.3
  CVE-2026-105298

  Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

  Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority value, but the upstream …

  Cloudflare https://github.com/cloudflare/pingora pingora-core crates.io
  Oct 20, 2026
• High 7.5
  CVE-2026-105297

  Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits

  Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references t…

  Cloudflare https://github.com/cloudflare/pingora pingora-core crates.io
  Oct 20, 2026
• Critical 9.3
  CVE-2026-2835 Public exploit

  HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

  An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Tran…

  Cloudflare https://github.com/cloudflare/pingora pingora-core crates.io
  Mar 4, 2026
• Critical 9.3
  CVE-2026-2833

  HTTP Request Smuggling via Premature Upgrade

  An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a request containing an Upgrade header, causing the proxy to pass through the rest of the bytes on t…

  Cloudflare https://github.com/cloudflare/pingora pingora-core crates.io
  Mar 4, 2026
• High —
  GHSA-393w-9x6h-8gc7

  Pingora update for MadeYouReset HTTP/2 vulnerability

  Pingora deployments that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed …

  pingora-core crates.io
  Sep 17, 2025
• High 7.5
  CVE-2025-8671 Public exploit

  CVE-2025-8671

  A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening stre…

  varnish-software Wind River Systems Fastly SUSE Linux Linux Debian Ubuntu Alpine crates.io
  Aug 13, 2025
• High 7.4
  CVE-2025-4366

  Request Smuggling Vulnerability in Pingora

  A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisonin…

  pingora-core crates.io
  May 22, 2025