CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority value, but the upstream received the client-supplied Host value. Pingora also accepted :authority values containing userinfo (for example, user@example.com). This violates RFC 9113 Section 8.3.1, which requires an intermediary to use the :authority value for Host and replace any existing Host field. Root cause * HTTP/2 to HTTP/1.1: Host was generated from :authority only when the request had no Host header, so a conflicting client Host was forwarded unchanged. * HTTP/2 to HTTP/2: the client Host header was removed and used to overwrite the upstream :authority, after request filters had already run against the original :authority. * The HTTP/2 server did not compare Host with :authority and did not reject userinfo in the authority. Impact A remote, unauthenticated attacker can send a single HTTP/2 request that the application sees as one host and the upstream receives as another. Where request filters, access controls, or cache keys use the URI authority and the upstream routes by Host, this can lead to: * Cache poisoning: a response from another virtual host is stored under the victim host's cache key and served to other users (this also requires the upstream to serve different content per Host). * Host-based access control bypass: a request approved for one host is served by a different virtual host on the upstream. Deployments that do not accept HTTP/2 from clients, or that do not use the request authority for security or caching decisions, are not affected. Note that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients. Mitigation: * Upgrade to pingora 0.9.0 or later. Pingora now returns 400 Bad Request for HTTP/2 requests whose Host differs from :authority, that contain more than one Host, or whose authority contains userinfo, and keeps the upstream Host or :authority consistent with the request authority. Fix commits: https://github.com/cloudflare/pingora/commit/915590a91811877795531f6ba0927a3138b5cb4b , https://github.com/cloudflare/pingora/commit/ffab8302d08d4292d1924eb8fe84647fd5cb8e76 * If you cannot upgrade: in request_filter, reject HTTP/2 requests that carry a Host header different from the URI authority, or whose authority contains '@'.

• CWE-444

• https://github.com/cloudflare/pingora

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105291A vulnerability was identified in feelec-yishu feelcrm-os 1.…4.3
• CVE-2026-105292Chaterm before 0.12.1 contains a login cross-site request fo…5.9
• CVE-2026-105293Legcord 1.1.0 through 1.3.0 contains a path traversal vulner…8.1
• CVE-2026-105294Legcord 1.1.0 through 1.3.0 contains a configuration injecti…7.4
• CVE-2026-105295GitAhead 2.5.0 through 2.7.1 contains an insecure update mec…7.5
• CVE-2026-105297Summary Before version 0.8.1, Pingora's HTTP/2 server use…7.5
• CVE-2026-105299Summary Before version 0.9.0, the HTTP/1 upstream path in…8.7
• CVE-2026-1053The Ivory Search – WordPress Search Plugin plugin for WordPr…4.4
• CVE-2026-10530The Pie Register WordPress plugin before 3.8.4.10 does not …5.3
• CVE-2026-105301Rejected reason: This candidate was rejected after further i…
• CVE-2026-105302A flaw was found in the User Session Note mapper of the Keyc…5.7
• CVE-2026-105305A flaw was found in the OIDC implementation of Keycloak, spe…5.4