{"answers":{"affected":"1 open source package ship an affected version, including pingora-core.","exploited":"There is no known exploitation of CVE-2026-105298 in the wild and no public exploit code.","fix":"Upgrade pingora-core to 0.9.0 or later.","what":"CVE-2026-105298 is a medium-severity vulnerability in https://github.com/cloudflare/pingora, published on 20 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-105298 and fix it if it is affected.\n\nWhat it is: CVE-2026-105298 is a medium-severity vulnerability in https://github.com/cloudflare/pingora, published on 20 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-105298 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- pingora-core (crates.io): affected from 0.0.0-0; fixed in 0.9.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-105298/ (Markdown: https://insights.sbomify.com/CVE-2026-105298/index.md)","id":"CVE-2026-105298","markdown":"https://insights.sbomify.com/CVE-2026-105298/index.md","name":"CVE-2026-105298","record":{"aliases":["GHSA-fqwv-pcm9-9m42","GHSA-mgg9-6xw2-jfgp","RUSTSEC-2026-0388"],"analysis":null,"analysis_generated_by":null,"assigner":"cloudflare","cpe":[],"cvss":{"score":6.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"description":"Summary\n\nBefore version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority value, but the upstream received the client-supplied Host value. Pingora also accepted :authority values containing userinfo (for example, user@example.com). This violates RFC 9113 Section 8.3.1, which requires an intermediary to use the :authority value for Host and replace any existing Host field.\n\nRoot cause\n\n  *  \n\nHTTP/2 to HTTP/1.1: Host was generated from :authority only when the request had no Host header, so a conflicting client Host was forwarded unchanged.\n\n  *  \n\nHTTP/2 to HTTP/2: the client Host header was removed and used to overwrite the upstream :authority, after request filters had already run against the original :authority.\n\n  *  \n\nThe HTTP/2 server did not compare Host with :authority and did not reject userinfo in the authority.\n\nImpact\n\nA remote, unauthenticated attacker can send a single HTTP/2 request that the application sees as one host and the upstream receives as another. Where request filters, access controls, or cache keys use the URI authority and the upstream routes by Host, this can lead to:\n\n  *  \n\nCache poisoning: a response from another virtual host is stored under the victim host's cache key and served to other users (this also requires the upstream to serve different content per Host).\n\n  *  \n\nHost-based access control bypass: a request approved for one host is served by a different virtual host on the upstream.\n\nDeployments that do not accept HTTP/2 from clients, or that do not use the request authority for security or caching decisions, are not affected.\n\nNote that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.\n\nMitigation:\n\n  *  \n\nUpgrade to pingora 0.9.0 or later. Pingora now returns 400 Bad Request for HTTP/2 requests whose Host differs from :authority, that contain more than one Host, or whose authority contains userinfo, and keeps the upstream Host or :authority consistent with the request authority. Fix commits:  https://github.com/cloudflare/pingora/commit/915590a91811877795531f6ba0927a3138b5cb4b ,  https://github.com/cloudflare/pingora/commit/ffab8302d08d4292d1924eb8fe84647fd5cb8e76 \n\n  *  \n\nIf you cannot upgrade: in request_filter, reject HTTP/2 requests that carry a Host header different from the URI authority, or whose authority contains '@'.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass","id":"CVE-2026-105298","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":1,"next":{"headline":"Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wr","id":"CVE-2026-105299"},"packages":[{"ecosystem":"crates.io","fixed":["0.9.0"],"introduced":["0.0.0-0"],"last_affected":[],"package":"pingora-core","purl":"pkg:cargo/pingora-core","source":"RUSTSEC-2026-0388"}],"prev":{"headline":"Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits","id":"CVE-2026-105297"},"products":["https://github.com/cloudflare/pingora"],"published":"2026-10-20","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-20","vendors":["Cloudflare"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-105298/"}