Httpsgithub.comcloudflarepingora (Cloudflare) - vulnerabilities (CVEs)

6 CVEs, 3 in the last 30 days, 2 known versions, newest CVE from 2026-10-20. Vendor: Cloudflare.

CVEs of Httpsgithub.comcloudflarepingora

• CVE-2026-105299 - CVSS 8.7 (high), 2026-10-20: Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the…
• CVE-2026-105298 - CVSS 6.3 (medium), 2026-10-20: Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and…
• CVE-2026-105297 - CVSS 7.5 (high), 2026-10-20: Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size…
• CVE-2026-2836 - CVSS 8.4 (high), 2026-03-05: A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP…
• CVE-2026-2835 - CVSS 9.3 (critical), 2026-03-05: An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to…
• CVE-2026-2833 - CVSS 9.3 (critical), 2026-03-05: An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads…