Cloudflare https://github.com/cloudflare/pingora vulnerabilities

Newest CVEs

• CVE-2026-105299

  Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments

  Cloudflare · https://github.com/cloudflare/pingora

  High8.7
• CVE-2026-105298

  Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

  Cloudflare · https://github.com/cloudflare/pingora

  Medium6.3
• CVE-2026-105297

  Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits

  Cloudflare · https://github.com/cloudflare/pingora

  High7.5
• CVE-2026-2836

  Cache poisoning via insecure-by-default cache key

  Cloudflare · https://github.com/cloudflare/pingora

  High8.4
• CVE-2026-2835

  HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

  Cloudflare · https://github.com/cloudflare/pingora

  Critical9.3
• CVE-2026-2833

  HTTP Request Smuggling via Premature Upgrade

  Cloudflare · https://github.com/cloudflare/pingora

  Critical9.3