CVE-2026-75753

Certain ASUS routers are affected by a Missing Authentication for a Critical Function vulnerability. This flaw allows an unauthorized nearby user to send specific commands via HTTP requests , which can cause the router to reveal device identification information and switch into a specific mode. C...

CVE-2026-75753

Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal...

CVE-2026-75753

Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal...

CVE-2026-17518

Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section ...

EUVD-2026-104783

Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section ...

CVE-2026-17518

Certain ASUS router models are vulnerable to a buffer copy without checking the size of input . This flaw allows an adjacent authenticated user to send an HTTP request with input exceeding the expected length, potentially leading to corrupted device operations or a denial of service (DoS) . Remed...

CVE-2026-105297

Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the serv...

CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105299

Versions of pingora-proxy before 0.9.0 are vulnerable to an ACL bypass because the HTTP/1 upstream path fails to remove client-nominated Connection headers and associated hop-by-hop headers, violating RFC 9110. An attacker can nominate a header that the application subsequently adds in upstream_r...

CVE-2026-105299 Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...

CVE-2026-105299

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...

EUVD-2026-104781

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...

CVE-2026-105299 Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...

CVE-2026-105299 Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...

EUVD-2026-104695

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105298

Versions of Pingora prior to 0.9.0 are vulnerable to a security issue where the software accepts HTTP/2 requests with a Host header that differs from the :authority pseudo-header. The root cause involves the server failing to compare these values or reject userinfo in the authority, violating RFC...

CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...