HTTP/2 Host Header Vulnerability in Pingora by Cloudflare

CVE-2026-105298

What is CVE-2026-105298?

Pingora, an HTTP/2 server developed by Cloudflare, exhibits a vulnerability where it improperly handles HTTP/2 requests with a Host header that differs from the :authority pseudo-header. This discrepancy can lead to several security issues, such as cache poisoning, where responses from unintended virtual hosts can be served to users, compromising the integrity of cached content. Furthermore, unauthorized access can occur as requests approved for one virtual host may be illicitly served by another. This vulnerability stems from lax checks between the Host and :authority headers, allowing remote, unauthenticated attackers to exploit this condition. Users are strongly advised to upgrade to version 0.9.0 or later to mitigate these risks effectively.

References