Cloudflare Pingora CVE-2026-105297

Exploitable only against Pingora services that terminate HTTP/2 (h2 cleartext/h2c or over TLS) and do NOT explicitly set both max_header_list_size and max_concurrent_streams - i.e., services on versions before 0.8.1 that supply no H2Options, or any version using H2Options::default() (which does not include these limits). No authentication, user interaction, or special network position is required (PR:N/UI:N/AV:N). Key limiting factors: the service must actually expose HTTP/2 termination to the attacker, and deployments that already supply custom H2Options with both limits set - or that upgrade to 0.8.1+ and start from pingora_core::protocols::http::v2::server::default_h2_options() - are not vulnerable. Cloudflare's internal CDN services were not exposed because they have no HTTP/2 clients.

Signals are largely consistent in pointing to a genuine but availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) indicates a remote, unauthenticated, low-complexity attack with high availability impact and no confidentiality or integrity exposure, which matches the CWE-770 (uncontrolled resource allocation) memory-exhaustion DoS described. KEV status is NOT present, so there is no evidence of active exploitation, and no POC=YES flag is set, so there is no confirmed public exploit; however, the Cloudflare advisory states the reporter demonstrated that a single connection could OOM-kill a Pingora process with a 2 GiB limit, so the technical feasibility is vendor-confirmed even if weaponized public code is not identified. EPSS was NOT provided in the input, so probabilistic exploitation likelihood cannot be quantified here. There is no SSVC decision data in the input. Net: this is a credible, easy-to-trigger DoS worth prioritizing for any internet-facing Pingora deployment that terminates HTTP/2 with default H2Options, but it is not a confidentiality/integrity breach and is not confirmed as being exploited in the wild - treat it as a high-priority availability patch rather than a critical compromise. Note the self-limiting exposure: Cloudflare states its own CDN customers were unaffected because internal Pingora services have no HTTP/2 clients, so real risk is concentrated in third-party operators who expose Pingora's HTTP/2 termination publicly.

A remote, unauthenticated attacker opens a single HTTP/2 (h2 or h2c) connection to an internet-facing Pingora service that uses default h2-crate limits, then sends 1-byte HPACK references to a near-empty header to force the server to allocate hundreds of thousands of header fields per stream, opening an unlimited number of concurrent streams and holding them open via HTTP/2 flow control. Memory is exhausted and the Pingora process degrades or is OOM-killed, denying service to legitimate clients. No public exploit code is identified, but the reporter demonstrated a working single-connection OOM-kill.