CVE-2026-105298: Vulnerability in Cloudflare https://github.com/cloudflare/pingora

Before version 0.9.0, Pingora accepted HTTP/2 requests with mismatched Host and :authority headers, and allowed :authority values containing userinfo, violating RFC 9113 Section 8.3.1. The root cause was that the HTTP/2 to HTTP/1.1 translation used :authority only if no Host header existed, forwarding conflicting Host headers unchanged, and the HTTP/2 server did not validate or reject userinfo in :authority. This allowed remote unauthenticated attackers to craft requests that appear as one host to request filters and logs but are routed to a different upstream host, potentially causing cache poisoning or host-based access control bypass. Deployments not using HTTP/2 or not relying on authority for security or caching are unaffected. Cloudflare internal services are not affected as they do not accept HTTP/2 clients. The issue is fixed in Pingora 0.9.0 by rejecting requests with mismatched Host and :authority headers or userinfo in :authority.

A remote unauthenticated attacker can exploit the mismatch between Host and :authority headers to poison caches or bypass host-based access controls if the deployment uses the request URI authority for filtering, caching, or access decisions. This can result in serving responses from one virtual host under another host's cache key or unauthorized access to different virtual hosts upstream. Deployments not accepting HTTP/2 or not using the authority for security or caching are not impacted. Cloudflare CDN customers are unaffected.

Upgrade to Pingora version 0.9.0 or later, which rejects HTTP/2 requests with mismatched Host and :authority headers, multiple Host headers, or :authority containing userinfo, ensuring consistency between upstream Host and request authority. If upgrading is not possible, implement a request filter to reject HTTP/2 requests where the Host header differs from the :authority or where the :authority contains '@'.