pingora
0.9.1A library for building fast, reliable and evolvable network services.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 8 advisories2 critical, 5 high, 1 medium
- Supported versions
- No scheduleendoflife.date does not track this project
27.9k stars · 1.8k forks · 325 open issues · last release 12 days ago · data checked 57 minutes ago
Security advisories
All advisories on GitHubThe 8 most recent advisories published by the maintainers: 2 critical, 5 high, 1 medium. Check the patched version against the one you run.
- highCVE-2026-105297Oct 20, 2026Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
- Affected
- < 0.8.1
- Patched in
- 0.8.1
- mediumCVE-2026-105298Oct 20, 2026Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
- Affected
- < 0.9.0
- Patched in
- 0.9.0
- highCVE-2026-105299Oct 20, 2026Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
- Affected
- < 0.9.0
- Patched in
- 0.9.0
- highCVE-2026-2836Mar 5, 2026Cache poisoning via insecure-by-default cache key
- Affected
- <=0.7.0
- Patched in
- 0.8.0
- criticalCVE-2026-2835Mar 5, 2026HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing
- Affected
- <=0.7.0
- Patched in
- 0.8.0
- criticalCVE-2026-2833Mar 5, 2026HTTP Request Smuggling via Premature Upgrade
- Affected
- <=0.7.0
- Patched in
- 0.8.0
- highCVE-2025-8671Sep 17, 2025Pingora update for MadeYouReset HTTP/2 vulnerability
- Affected
- < 0.6.0
- Patched in
- >= 0.6.0
- highCVE-2025-4366Jun 20, 2025Request Smuggling Vulnerability in Pingora
- Affected
- < 0.5.0
- Patched in
- >= 0.5.0