CVE-2026-105297: CWE-770 Allocation of resources without limits or throttling in Cloudflare https://github.com/cloudflare/pingora

Before Pingora version 0.8.1, the HTTP/2 server relied on the h2 crate's default limits, which did not impose explicit caps on decoded header-list size or concurrent streams unless set by the application. An attacker can exploit this by sending minimal HPACK references to a near-empty header, causing the server to allocate hundreds of thousands of header fields per stream across unlimited streams on a single connection. Using HTTP/2 flow control, the attacker can keep these streams open, exhausting server memory and causing denial of service. The issue is addressed in version 0.8.1 by introducing default limits of 64 KiB for decoded header-list size and a maximum of 100 concurrent streams per connection. Applications that supply custom H2Options must explicitly set these limits or use the new default options introduced in 0.8.1.

A remote, unauthenticated attacker can cause a denial of service by exhausting memory on any Pingora service terminating HTTP/2 connections without explicit limits on header-list size and concurrent streams. This can lead to out-of-memory process termination, as demonstrated with a 2 GiB memory limit environment. There is no impact on confidentiality or integrity, and Cloudflare CDN customers are unaffected due to their internal architecture.

Upgrade to Pingora version 0.8.1 or later, which enforces default limits on decoded header-list size (64 KiB) and concurrent streams (100). For applications using custom H2Options, explicitly set max_header_list_size and max_concurrent_streams to appropriate limits, or start from the default_h2_options() provided in pingora_core::protocols::http::v2::server in version 0.8.1 and later. These mitigations prevent excessive resource allocation and denial of service.