Cloudflare Pingora vulnerabilities

• cloudflare https://github.com/cloudflare/pingora Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments CVE-2026-105299 Fix available 8.7 HighOctober 20, 2026
• cloudflare https://github.com/cloudflare/pingora Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass CVE-2026-105298 Fix available 6.3 MediumOctober 20, 2026
• cloudflare https://github.com/cloudflare/pingora Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits CVE-2026-105297 Fix available 7.5 HighOctober 20, 2026
• cloudflare pingora, https://github.com/cloudflare/pingora +1 more Cache poisoning via insecure-by-default cache key CVE-2026-2836 Fix available 8.4 HighMarch 4, 2026
• cloudflare pingora, https://github.com/cloudflare/pingora +1 more HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing CVE-2026-2835 Fix available 9.3 CriticalMarch 4, 2026
• cloudflare pingora, https://github.com/cloudflare/pingora +1 more HTTP Request Smuggling via Premature Upgrade CVE-2026-2833 Fix available 9.3 CriticalMarch 4, 2026
• cloudflare pingora Request Smuggling Vulnerability in Pingora CVE-2025-4366 Fix available 7.4 HighMay 22, 2025