All 6 CVE vulnerabilities found in https://github.com/cloudflare/pingora, with AI-generated Chinese analysis, references, and POCs.
Vendor: Cloudflare
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-105299 | Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments | 8.7 | High | 2026-10-20 |
| CVE-2026-105298 | Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass | 6.3 | Medium | 2026-10-20 |
| CVE-2026-105297 | Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits CWE-770 | 7.5 | High | 2026-10-20 |
| CVE-2026-2836 | Cache poisoning via insecure-by-default cache key | 6.5AI | Medium AI | 2026-03-04 |
| CVE-2026-2835 | HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing CWE-444 | 7.5AI | High AI | 2026-03-04 |
| CVE-2026-2833 | HTTP Request Smuggling via Premature Upgrade CWE-444 | 7.5AI | High AI | 2026-03-04 |
All 6 known CVE vulnerabilities affecting https://github.com/cloudflare/pingora with full Chinese analysis, references, and POCs where available.