CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...