Skip to content
OpenAdvisories

Product · Cloudflare

https://github.com/cloudflare/pingora

6 known vulnerabilities.

All Critical High Medium Low Exploited only

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2026-105298

    Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

    Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority value, but the upstream …

    Cloudflare https://github.com/cloudflare/pingora pingora-core crates.io