{"id":"CVE-2026-105297","kind":"vulnerability","aliases":["CVE-2026-105297"],"related":[],"title":"Pingora: HTTP/2 server lacks header and stream limits, enabling memory exhaustion","description":"Summary\n\n\n\nBefore version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process.\n\n\n\n\nImpact\n\n\n\nRemote, unauthenticated denial of service against any Pingora service that terminates HTTP/2 (h2 or h2c) without explicitly setting max_header_list_size and max_concurrent_streams. The reporter showed that a single connection could get a Pingora process with a 2 GiB memory limit OOM-killed.\n\n\n\n\nNote that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.\n\n\n\nMitigation:\n\n  *  \n\nUpgrade to pingora 0.8.1 or later (fix:  https://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd ). When no H2Options are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection.\n\n\n  *  \n\nApplications that supply their own H2Options are not covered by these defaults and must set max_header_list_size and max_concurrent_streams explicitly (this also works on versions before 0.8.1), or, on 0.8.1 and later, start from pingora_core::protocols::http::v2::server::default_h2_options(). H2Options::default() does not include these limits.","summary":"Pingora's HTTP/2 server, before 0.8.1, used the h2 crate's default limits unless the application set its own header-list and concurrent-stream limits. A remote unauthenticated client can send tiny HPACK references to make the server allocate huge numbers of header fields across unlimited streams on one connection, exhausting memory and crashing the process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http2","package","pingora","rust","self-hosted"],"not_affected_if":["behind-trusted-proxy","default-h2-options-on-0.8.1","http1-only"],"how_to_check":"- Check the `pingora` version in `Cargo.lock` or `Cargo.toml`; anything below `0.8.1` is exposed if HTTP/2 is terminated.\n- Search the application code for `H2Options` to see whether `max_header_list_size` and `max_concurrent_streams` are set explicitly.\n- Confirm whether the service accepts HTTP/2 (h2 or h2c) from untrusted clients.","fix":"- Upgrade the `pingora` crate to `0.8.1` or later.\n- If the application supplies its own `H2Options`, set `max_header_list_size` and `max_concurrent_streams` explicitly, or start from `pingora_core::protocols::http::v2::server::default_h2_options()` on `0.8.1` and later.\n- Note that `H2Options::default()` does not include these limits.","status":"open","published_at":"2026-10-20T01:17:09+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:22:52+00:00","updated_at":"2026-10-25T03:22:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:22:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `pingora` crate to `0.8.1` or later.\n- If the application supplies its own `H2Options`, set `max_header_list_size` and `max_concurrent_streams` explicitly, or start from `pingora_core::protocols::http::v2::server::default_h2_options()` on `0.8.1` and later.\n- Note that `H2Options::default()` does not include these limits.","reach":"internet","title":"Pingora: HTTP/2 server lacks header and stream limits, enabling memory exhaustion","impact":"medium","summary":"Pingora's HTTP/2 server, before 0.8.1, used the h2 crate's default limits unless the application set its own header-list and concurrent-stream limits. A remote unauthenticated client can send tiny HPACK references to make the server allocate huge numbers of header fields across unlimited streams on one connection, exhausting memory and crashing the process.","category":"package","nicknames":[],"who_cares":["pingora","rust","self-hosted","http2"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker crashes or OOM-kills the Pingora process.","analyst_note":"","how_to_check":"- Check the `pingora` version in `Cargo.lock` or `Cargo.toml`; anything below `0.8.1` is exposed if HTTP/2 is terminated.\n- Search the application code for `H2Options` to see whether `max_header_list_size` and `max_concurrent_streams` are set explicitly.\n- Confirm whether the service accepts HTTP/2 (h2 or h2c) from untrusted clients.","needs_analyst":false,"not_affected_if":["http1-only","behind-trusted-proxy","default-h2-options-on-0.8.1"],"who_is_affected":"Applications built on Pingora that terminate HTTP/2 (h2 or h2c) directly from untrusted clients are exposed, especially those that supply their own H2Options without the limits. Services that do not expose HTTP/2 to untrusted clients, or that run on the fixed defaults, are not affected. The sources note Cloudflare CDN customers were unaffected because internal Pingora services have no HTTP/2 clients.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000776,"input_tokens":3817,"output_tokens":788,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105297':14A,17A '-2026':13A,16A '/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd':251C '0.8.1':30B,86C,245C,308C,311C '1':123C '100':273C '16':104C '2':216C '64':263C 'across':71B,145C 'advertis':259C 'alloc':65B,136C 'also':303C 'applic':40B,100C,278C 'byte':124C 'cdn':226C 'client':55B,120C,240C 'cloudflar':225C,235C 'concurr':49B,115C,200C,274C,299C 'concurrent-stream':48B 'connect':76B,153C,208C,277C 'control':158C 'core':317C 'could':209C 'cover':286C 'crash':80B 'crate':34B,94C 'custom':227C 'cve':12A,15A 'decod':106C,265C 'default':36B,96C,289C,322C,326C 'degrad':169C 'denial':178C 'empti':131C 'enabl':9A 'enforc':261C 'exhaust':11A,77B,166C 'explicit':192C,301C 'field':70B,142C 'fix':248C 'flow':157C 'get':210C 'gib':217C 'github.com':250C 'github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd':249C 'h2':33B,93C,188C,323C 'h2c':190C 'h2options':254C,283C,325C 'header':5A,45B,69B,108C,132C,141C,195C,267C,294C 'header-list':44B,107C,266C 'host':24B 'hpack':59B,125C 'http':319C 'http/2':2A,27B,89C,156C,187C,239C 'http2':18B 'huge':66B 'hundr':137C 'impact':175C 'includ':329C 'intern':231C 'keep':160C 'kib':264C 'kill':222C 'lack':4A 'later':247C,313C 'limit':8A,37B,51B,97C,113C,219C,269C,331C 'list':46B,109C,196C,268C,295C 'make':62B,133C 'max':194C,199C,293C,298C 'memori':10A,78B,167C,218C 'mib':105C 'mitig':241C 'must':291C 'near':130C 'near-empti':129C 'note':223C 'number':67B,148C 'one':75B,152C 'oom':221C 'oom-kil':220C 'open':163C 'option':324C 'packag':19B 'per':143C,276C 'pingora':1A,20B,25B,87C,173C,183C,212C,232C,244C,257C,316C 'process':82B,174C,213C 'protocol':318C 'refer':60B,126C 'remot':53B,118C,176C 'report':203C 'rust':21B 'self':23B 'self-host':22B 'send':57B,122C 'server':3A,28B,64B,90C,135C,321C 'servic':180C,184C,233C 'set':41B,101C,193C,292C 'show':204C 'singl':207C 'size':110C,197C,296C 'start':314C 'stream':7A,50B,73B,116C,144C,150C,162C,201C,275C,300C 'summari':83C 'suppli':256C,280C 'termin':171C,186C 'thousand':139C 'tini':58B 'unaffect':229C 'unauthent':54B,119C,177C 'unless':38B,98C 'unlimit':72B,147C 'upgrad':242C 'use':31B,91C,155C 'v2':320C 'version':85C,306C 'without':191C 'work':304C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Pingora that terminate HTTP/2 (h2 or h2c) directly from untrusted clients are exposed, especially those that supply their own H2Options without the limits. Services that do not expose HTTP/2 to untrusted clients, or that run on the fixed defaults, are not affected. The sources note Cloudflare CDN customers were unaffected because internal Pingora services have no HTTP/2 clients.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cna@cloudflare.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105297","severity":null,"published_at":"2026-10-20T01:17:09+00:00","modified_at":"2026-10-20T20:17:11+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}