HT
Product
https://github.com/cloudflare/pingora
6
CVEs
0
On KEV
9.1
Max CVSS
3
New 30D
Severity mix
Critical 2High 3Medium 1Low 0
Watch
Add https://github.com/cloudflare/pingora to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-2835 | 9.1 | Mar 4 | HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing Affected: before 0.8.0 |
| CVE-2026-2833 | 9.1 | Mar 4 | HTTP Request Smuggling via Premature Upgrade Affected: before 0.8.0 |
| CVE-2026-105299 | 8.7 | Oct 20 | Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments Affected: 0.1.0 before 0.9.0 |
| CVE-2026-2836 | 8.1 | Mar 4 | Cache poisoning via insecure-by-default cache key Affected: before 0.8.0 |
| CVE-2026-105297 | 7.5 | Oct 20 | Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits Affected: 0.1.0 before 0.8.1 |
| CVE-2026-105298 | 6.3 | Oct 20 | Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass Affected: 0.1.0 before 0.9.0 |
Showing 6