CVE-2026-105298: https://github.com/cloudflare/pingora 0.1.0 to before 0.9.0

Affected technology

https://github.com/cloudflare/pingora · 0.1.0 to before 0.9.0
Cloudflare

Description’s affected range: Before version 0.9.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated attacker can send a single HTTP/2 request that the application sees as one host and the upstream receives as another. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality, integrity and availability impact as none.

Published 20-Oct-2026 01:49 UTC

KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-20 01:44:01.123206+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-105298.html