Pingora versions prior to 0.8.1 used the h2 crate's default HTTP/2 server limits, a 16 MiB decoded header-list size and no limit on concurrent streams, unless the application set its own. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process.
This affects any Pingora service that terminates HTTP/2 (h2 or h2c) without explicitly setting `max_header_list_size` and `max_concurrent_streams`. The reporter showed that a single connection could get a Pingora process with a 2 GiB memory limit OOM-killed.
This flaw was corrected in commit d193c8d49b8b7c1c1ede93183759caa4f6906bbd. When no `H2Options` are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection. Users should upgrade to Pingora >= 0.8.1. Applications that supply their own `H2Options` are not covered by these defaults and must set `max_header_list_size` and `max_concurrent_streams` explicitly, or start from `pingora_core::protocols::http::v2::server::default_h2_options()`. `H2Options::default()` does not include these limits.
Note: Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.
Pingora versions prior to 0.9.0 accepted HTTP/2 requests whose Host header differed from the `:authority` pseudo-header. Request filters, cache keys, and logs that read the request URI (`session.req_header().uri`) saw the `:authority` value, but the upstream received the client-supplied Host value. Pingora also accepted `:authority` values containing userinfo (for example, `user@example.com`). This violates RFC 9113 Section 8.3.1, which requires an intermediary to use the `:authority` value for Host and replace any existing Host field.
A remote, unauthenticated attacker can send a single HTTP/2 request that the application sees as one host and the upstream receives as another. Where request filters, access controls, or cache keys use the URI authority and the upstream routes by Host, this can lead to cache poisoning, where a response from another virtual host is stored under the victim host's cache key and served to other users, or host-based access control bypass, where a request approved for one host is served by a different virtual host on the upstream. Deployments that do not accept HTTP/2 from clients, or that do not use the request authority for security or caching decisions, are not affected.
This flaw was corrected in commits 915590a91811877795531f6ba0927a3138b5cb4b and ffab8302d08d4292d1924eb8fe84647fd5cb8e76. Pingora now returns 400 Bad Request for HTTP/2 requests whose Host differs from `:authority`, that contain more than one Host, or whose authority contains userinfo, and keeps the upstream Host or `:authority` consistent with the request authority. Users should upgrade to Pingora >= 0.9.0.
Note: Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.