GHSA-393w-9x6h-8gc7 Pingora update for MadeYouReset HTTP/2 vulnerability
Malicious clients can cause excessive memory consumption and denial of service in Pingora HTTP/2 servers by triggering repeated resets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-393w-9x6h-8gc7?
GHSA-393w-9x6h-8gc7 is a denial of service vulnerability in pingora-core, published on 17 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pingora deployments that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed by the server. Repeated resets can force excessive memory consumption and lead to denial-of-service.
Impact: On affected versions, malicious clients could trigger unusually high memory consumption, which may result in service instability or process termination.
Credits: Reported responsibly by security researcher Gal Bar Nahum (@galbarnahum)
Mitigation: This issue is addressed by ensuring Pingora uses patched versions of HTTP/2 dependencies that include reset-handling safeguards to release connection resources before excessive memory buildup. Users should upgrade to the latest Pingora release, which incorporates the required fixes.
- Users are requested to upgrade to latest version of Pingora >= 0.6.0
Which versions are affected by GHSA-393w-9x6h-8gc7?
2 open source packages ship an affected version, including pingora-core.
| Package | Affected | Fixed in |
|---|---|---|
pingora-core crates.io | All versions | 0.6.0 |
pingora-core crates.io | All versions | 0.6.0 |
How do I fix GHSA-393w-9x6h-8gc7?
Upgrade pingora-core to 0.6.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-393w-9x6h-8gc7 being exploited?
There is no known exploitation of GHSA-393w-9x6h-8gc7 in the wild and no public exploit code.