Pingora HTTP/2 DoS via Memory Leak (RUSTSEC-2026-0389 / CVE-2026-102971)

Vulnerability Overview Vulnerability ID: RUSTSEC-2026-0389 Vulnerability Name: Pingora HTTP/2 Server Memory Leak via Unbound Default Header-List and Concurrent Stream Limits Publication Date: October 20, 2026 Report Date: October 20, 2026 Type: Vulnerability Category: Denial of Service Keywords: http2, http2, http2 Aliases: CVE-2026-102971, GHSA-7qjv-4h12-422 Scope of Impact Affected Versions: 0.8.2 and earlier Attack Complexity: Low Attack Requirements: None Attack Vector: Network Required Privileges: None Impact on Availability of Subsequent Systems: None Impact on Confidentiality of Subsequent Systems: None Impact on Integrity of Subsequent Systems: None User Interaction: None Impact on Availability of Vulnerable Systems: High Impact on Confidentiality of Vulnerable Systems: None Impact on Integrity of Vulnerable Systems: None CVSS Score: 7.5 (High) Description Rust's default HTTP/2 server in versions below 0.8.3 exposes a 16 MB decoded header-list limit and lacks limits on concurrent streams. When an application does not set and , a malicious, unauthenticated client can trigger an almost infinite memory leak. This causes the server to allocate hundreds of kilobyte-sized header fields and an unlimited number of streams, while using HTTP/2 flow control to keep these streams open. This can exhaust server memory and lead to service termination. This affects any application using Pingora as an HTTP/2 server (version 0.8.2 or earlier) without explicitly setting and . The report indicates that a malicious connection can cause a Pingora process to exhaust 100 MB of memory within 2 seconds. This vulnerability has been fixed in commit . Without the parameter, Pingora no longer permits allocation and retention of the 16 MB decoded header-list limit, and enforces a maximum of 200 concurrent streams. Users should upgrade to Pingora >= 0.8.3. Applications that have not set and are affected by this vulnerability and must configure these values, or initiate from (note: defaults do not set these values). Note: Cloudflare CDN customers are not affected, as internal Pingora services within Cloudflare do not have HTTP/2 clients. Remediation Fixed Version: 0.8.3 and later Remediation Method: Upgrade to Pingora >= 0.8.3 and ensure and are configured. POC Code or Exploit Code No specific POC code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Pingora HTTP/2 DoS via Memory Leak (RUSTSEC-2026-0389 / CVE-2026-102971)

More from this source