pingap

Pingap A reverse proxy and application gateway built on Cloudflare Pingora. It is configured through TOML files or a web admin that is part of the binary, takes changes without a restart, and comes with more than thirty plugins. 中文说明 | Documentation · 中文文档 | Examples | Plugins | Crates | Upgradin...

zentinel

A security-first reverse proxy built to guard the free web A reverse proxy on Cloudflare Pingora with explicit limits, predictable failure modes and security logic in crash-isolated agents, for operators who want to sleep. Website · Docs · Playground · All repositories Zentinel is a reverse proxy...

CVE-2026-49975-HTTP-2-Bomb

A triage not exploitation tool to identify attack surfaces exposed to CVE-2026-49975 — "HTTP/2 Bomb". ⚠️ This script does not send attack payloads. It only makes normal HTTP requests and analyzes response headers to flag hosts that warrant manual version/patch verification. About CVE-2026-49975...

CVE-2026-105299

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...

CVE-2026-105297

Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the serv...

CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105299

Versions of pingora-proxy before 0.9.0 are vulnerable to an ACL bypass because the HTTP/1 upstream path fails to remove client-nominated Connection headers and associated hop-by-hop headers, violating RFC 9110. An attacker can nominate a header that the application subsequently adds in upstream_r...

EUVD-2026-104781

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...

CVE-2026-105299

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...

CVE-2026-105299 Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...

CVE-2026-105299 Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...

CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

EUVD-2026-104695

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105298

Versions of Pingora prior to 0.9.0 are vulnerable to a security issue where the software accepts HTTP/2 requests with a Host header that differs from the :authority pseudo-header. The root cause involves the server failing to compare these values or reject userinfo in the authority, violating RFC...

CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105297

The Pingora HTTP/2 server is vulnerable to a remote, unauthenticated denial of service (DoS) due to memory exhaustion. Before version 0.8.1 , the server used default limits that allowed a client to send 1-byte HPACK references to near-empty headers, forcing the server to allocate hundreds of thou...

CVE-2026-105297 Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits

Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the serv...

EUVD-2026-104678

Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the serv...

CVE-2026-105297 Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits

Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the serv...