{"id":"GHSA-393w-9x6h-8gc7","aliases":[],"status":"published","title":"Pingora update for MadeYouReset HTTP/2 vulnerability","description":"Pingora deployments that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed by the server. Repeated resets can force excessive memory consumption and lead to denial-of-service.\n\n**Impact**:\nOn affected versions, malicious clients could trigger unusually high memory consumption, which may result in service instability or process termination.\n\n**Credits**:\nReported responsibly by security researcher [Gal Bar Nahum](https://github.com/galbarnahum) (@[galbarnahum](https://github.com/galbarnahum))\n\n**Mitigation**:\nThis issue is addressed by ensuring Pingora uses patched versions of HTTP/2 dependencies that include reset-handling safeguards to release connection resources before excessive memory buildup. Users should upgrade to the latest Pingora release, which incorporates the required fixes.\n- Users are requested to upgrade to latest version of Pingora \u003e= 0.6.0","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-09-17T20:46:50Z","modified":"2025-09-17T20:46:51Z","fixes":[{"ecosystem":"crates.io","package":"pingora-core","fixed_in":["0.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"pingora-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"pingora-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]}],"references":[{"url":"https://github.com/cloudflare/pingora/security/advisories/GHSA-393w-9x6h-8gc7","tags":["web"]},{"url":"https://github.com/cloudflare/pingora/releases/tag/0.6.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-393w-9x6h-8gc7"},{"url":"https://github.com/cloudflare/pingora","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-393w-9x6h-8gc7","title":"Pingora update for MadeYouReset HTTP/2 vulnerability","description":"Pingora deployments that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed by the server. Repeated resets can force excessive memory consumption and lead to denial-of-service.\n\n**Impact**:\nOn affected versions, malicious clients could trigger unusually high memory consumption, which may result in service instability or process termination.\n\n**Credits**:\nReported responsibly by security researcher [Gal Bar Nahum](https://github.com/galbarnahum) (@[galbarnahum](https://github.com/galbarnahum))\n\n**Mitigation**:\nThis issue is addressed by ensuring Pingora uses patched versions of HTTP/2 dependencies that include reset-handling safeguards to release connection resources before excessive memory buildup. Users should upgrade to the latest Pingora release, which incorporates the required fixes.\n- Users are requested to upgrade to latest version of Pingora \u003e= 0.6.0","status":"published","published":"2025-09-17T20:46:50Z","modified":"2025-09-17T20:46:51Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","level":"high"}],"updated_at":"2026-11-02T14:38:58.107905Z"}],"osv":[{"id":"GHSA-393w-9x6h-8gc7","title":"Pingora update for MadeYouReset HTTP/2 vulnerability","description":"Pingora deployments that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed by the server. Repeated resets can force excessive memory consumption and lead to denial-of-service.\n\n**Impact**:\nOn affected versions, malicious clients could trigger unusually high memory consumption, which may result in service instability or process termination.\n\n**Credits**:\nReported responsibly by security researcher [Gal Bar Nahum](https://github.com/galbarnahum) (@[galbarnahum](https://github.com/galbarnahum))\n\n**Mitigation**:\nThis issue is addressed by ensuring Pingora uses patched versions of HTTP/2 dependencies that include reset-handling safeguards to release connection resources before excessive memory buildup. Users should upgrade to the latest Pingora release, which incorporates the required fixes.\n- Users are requested to upgrade to latest version of Pingora \u003e= 0.6.0","status":"published","published":"2025-09-17T20:46:50Z","modified":"2025-09-17T20:46:50Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","level":"high"}],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}