HT
Product
https://github.com/cloudflare/pingora
6
CVEs
0
On KEV
9.1
Max CVSS
3
New 30D
Severity mix
Critical 2High 3Medium 1Low 0
Watch
Add https://github.com/cloudflare/pingora to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105299 | 8.7 | Oct 20 | Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments Affected: 0.1.0 before 0.9.0 |
| CVE-2026-2836 | 8.1 | Mar 4 | Cache poisoning via insecure-by-default cache key Affected: before 0.8.0 |
| CVE-2026-105297 | 7.5 | Oct 20 | Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits Affected: 0.1.0 before 0.8.1 |
Showing 3