Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-105297: Pingora server can run out of memory
CVE-2026-105297 · published 15 days ago
Summary
If you use Pingora to handle HTTP/2 traffic and haven’t set limits on header size or the number of parallel streams, a remote attacker can force the server to consume large amounts of memory and crash. Upgrade to Pingora version 0.8.1 or later, and configure explicit limits for header size and concurrent streams if you customize the settings.
What to do
- Update pingora-core to version 0.8.1.
- Update cloudflare https://github.com/cloudflare/pingora to version 0.8.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | cloudflare | https://github.com/cloudflare/pingora | < 0.8.1 |
| crates.io | – | pingora-core |
>= 0.0.0-0, < 0.8.1 Fix: upgrade to 0.8.1
|
Original advisory text
Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
Pingora versions prior to 0.8.1 used the h2 crate's default HTTP/2 server limits, a 16 MiB decoded header-list size and no limit on concurrent streams, unless the application set its own. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process.
This affects any Pingora service that terminates HTTP/2 (h2 or h2c) without explicitly setting `max_header_list_size` and `max_concurrent_streams`. The reporter showed that a single connection could get a Pingora process with a 2 GiB memory limit OOM-killed.
This flaw was corrected in commit d193c8d49b8b7c1c1ede93183759caa4f6906bbd. When no `H2Options` are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection. Users should upgrade to Pingora >= 0.8.1. Applications that supply their own `H2Options` are not covered by these defaults and must set `max_header_list_size` and `max_concurrent_streams` explicitly, or start from `pingora_core::protocols::http::v2::server::default_h2_options()`. `H2Options::default()` does not include these limits.
Note: Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.
This affects any Pingora service that terminates HTTP/2 (h2 or h2c) without explicitly setting `max_header_list_size` and `max_concurrent_streams`. The reporter showed that a single connection could get a Pingora process with a 2 GiB memory limit OOM-killed.
This flaw was corrected in commit d193c8d49b8b7c1c1ede93183759caa4f6906bbd. When no `H2Options` are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection. Users should upgrade to Pingora >= 0.8.1. Applications that supply their own `H2Options` are not covered by these defaults and must set `max_header_list_size` and `max_concurrent_streams` explicitly, or start from `pingora_core::protocols::http::v2::server::default_h2_options()`. `H2Options::default()` does not include these limits.
Note: Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.
References
- https://github.com/cloudflare/pingora Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1052... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-105297 Vendor Advisory
- https://crates.io/crates/pingora-core Product
- https://rustsec.org/advisories/RUSTSEC-2026-0389.html Vendor Advisory
- https://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f69... URL
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published20 Oct 2026
Updated4 Nov 2026
First seen20 Oct 2026
Sources
CVE-2026-105297 · NVD
CVE-2026-105297 · OSV
CVE-2026-105297 · MITRE
RUSTSEC-2026-0389 · OSV
GHSA-7gpj-mj4q-x62x · GHSA
Track software like this
Free during beta