What’s Vulnerable › Products

Cloudflare https://github.com/cloudflare/pingora vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Cloudflare https://github.com/cloudflare/pingora version is affected

Latest Cloudflare https://github.com/cloudflare/pingora vulnerabilities

• CVE-2026-105299 — Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments (CVSS 8.7)
• CVE-2026-105298 — Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass (CVSS 6.3)
• CVE-2026-105297 — Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits (CVSS 7.5)
• CVE-2026-2836 — Cache poisoning via insecure-by-default cache key (CVSS 8.1)
• CVE-2026-2835 — HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing (CVSS 9.1)
• CVE-2026-2833 — HTTP Request Smuggling via Premature Upgrade (CVSS 9.1)
• CVE-2025-4366 — Request Smuggling Vulnerability in Pingora (CVSS 6.1)