Remote Denial of Service in Pingora's HTTP/2 Server by Cloudflare
CVE-2026-105297

7.5HIGH

Key Information:

Vendor

Cloudflare

Status
Https://github.com/cloudflare/pingora
Vendor
CVE Published:
20 October 2026

What is CVE-2026-105297?

Before the release of version 0.8.1, Pingora's HTTP/2 server was vulnerable to denial of service attacks due to improper handling of header-list size and concurrent streams. An unauthenticated remote client could exploit this vulnerability by sending minimal HPACK references, causing the server to allocate excessive memory for header fields across multiple streams. This opportunistic exploitation could lead to memory exhaustion, degrade performance, and potentially crash the Pingora process. Users are advised to upgrade to version 0.8.1 or later for enhanced security controls, including enforced limits on header-list size and maximum concurrent streams.

Affected Version(s)

https://github.com/cloudflare/pingora 0.1.0 < 0.8.1

References

https://github.com/cloudflare/pingora

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Reported by jro-calif (GitHub)
.