{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acloudflarepingora/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cloudflare:pingora:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-105297"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pingora (\u003c 0.8.1)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","network"],"_cs_type":"advisory","_cs_vendors":["Cloudflare"],"content_html":"\u003cp\u003ePingora versions prior to 0.8.1 contain a vulnerability related to the default handling of HTTP/2 protocol limits. The server failed to enforce strict limits on decoded header-list sizes and the number of concurrent streams when specific application-level configurations were omitted. An unauthenticated remote attacker can exploit this by sending crafted 1-byte HPACK references, forcing the server to allocate hundreds of thousands of header fields per stream across an unlimited number of concurrent streams. By manipulating HTTP/2 flow control, an attacker can maintain these streams indefinitely, leading to rapid memory exhaustion. This behavior results in an out-of-memory (OOM) condition, forcing the termination of the Pingora process and resulting in a denial-of-service for the affected service.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a standard TCP connection to a server running a vulnerable Pingora instance.\u003c/li\u003e\n\u003cli\u003eAttacker initiates an HTTP/2 handshake (h2 or h2c).\u003c/li\u003e\n\u003cli\u003eAttacker opens multiple concurrent HTTP/2 streams leveraging the lack of server-side stream limiting.\u003c/li\u003e\n\u003cli\u003eAttacker sends a series of 1-byte HPACK references directed at a near-empty header field.\u003c/li\u003e\n\u003cli\u003eThe Pingora server allocates massive numbers of header fields per stream to reconstruct the malicious headers.\u003c/li\u003e\n\u003cli\u003eAttacker uses HTTP/2 flow control mechanisms to keep the malicious streams open and active.\u003c/li\u003e\n\u003cli\u003eServer memory usage spikes until the operating system triggers an OOM-killer event for the Pingora process.\u003c/li\u003e\n\u003cli\u003eService availability is lost for legitimate users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a remote, unauthenticated denial-of-service. An attacker can crash a Pingora process with significant memory (e.g., 2 GiB) using a single connection. This vulnerability specifically impacts services terminating HTTP/2 traffic that rely on default Pingora configurations without explicitly setting \u003ccode\u003emax_header_list_size\u003c/code\u003e and \u003ccode\u003emax_concurrent_streams\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Pingora to version 0.8.1 or later to implement default safety limits.\u003c/li\u003e\n\u003cli\u003eFor applications using custom \u003ccode\u003eH2Options\u003c/code\u003e that cannot be upgraded, manually configure \u003ccode\u003emax_header_list_size\u003c/code\u003e and \u003ccode\u003emax_concurrent_streams\u003c/code\u003e in the application source code immediately.\u003c/li\u003e\n\u003cli\u003eDevelopers using Pingora 0.8.1 or later should leverage \u003ccode\u003epingora_core::protocols::http::v2::server::default_h2_options()\u003c/code\u003e instead of \u003ccode\u003eH2Options::default()\u003c/code\u003e to ensure recommended limits are applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T02:32:34Z","date_published":"2026-10-20T02:32:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pingora-dos/","summary":"A vulnerability in Pingora versions prior to 0.8.1 allows unauthenticated remote attackers to trigger out-of-memory termination via HTTP/2 header-list and stream resource exhaustion.","title":"Denial of Service via HTTP/2 Resource Exhaustion in Pingora","url":"https://feed.craftedsignal.io/briefs/2026-10-pingora-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:cloudflare:pingora:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}