Is CVE-2026-105297 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105297 being exploited in the wild.

How severe is CVE-2026-105297?

High severity, with a CVSS score of 7.5, published 20 October 2026.

Which products and versions are affected?

Cloudflare Pingora before 0.8.1; pingora-core (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.8.1.

How is CVE-2026-105297 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-105297?

Check whether you run Cloudflare Pingora or pingora-core (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105297: Pingora HTTP/2 server memory exhaustion via header injection

CVE-2026-105297 · Severity: high · CVSS 7.5 · Published 2026-10-20

Pingora is a reverse proxy and load balancer that handles HTTP/2 connections. An attacker can send specially crafted HTTP/2 headers that cause the server to allocate excessive memory across many concurrent streams, exhausting available memory and crashing the service, disrupting traffic to downstream applications.

Technologies: Cloudflare Pingora, pingora-core (crates.io). Vendors: Cloudflare, crates.io.

Quick answers

Is CVE-2026-105297 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105297 being exploited in the wild.
How severe is CVE-2026-105297?: High severity, with a CVSS score of 7.5, published 20 October 2026.
Which products and versions are affected?: Cloudflare Pingora before 0.8.1; pingora-core (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.8.1.
Is there a fix for CVE-2026-105297?: Yes. pingora-core (crates.io): upgrade to 0.8.1 or later. Until then: Upgrade to Pingora 0.8.1 or later, which enforces a 64 KiB decoded header-list limit and maximum of 100 concurrent streams by default. Applications supplying custom H2Options must explicitly set max_header_list_size and max_concurrent_streams, or use the default_h2_options() function on 0.8.1+. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105297 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-105297?: Check whether you run Cloudflare Pingora or pingora-core (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pingora-core (crates.io): upgrade to 0.8.1 or later
```
cargo update -p pingora-core
```

Upgrade to Pingora 0.8.1 or later, which enforces a 64 KiB decoded header-list limit and maximum of 100 concurrent streams by default. Applications supplying custom H2Options must explicitly set max_header_list_size and max_concurrent_streams, or use the default_h2_options() function on 0.8.1+.

Technical details

Pingora's HTTP/2 server implementation did not enforce limits on decoded header-list size and concurrent streams by default, instead relying on the h2 crate's permissive defaults. An unauthenticated remote attacker can craft HPACK-encoded headers with 1-byte references to force header field allocation across unlimited concurrent streams on a single connection, then use HTTP/2 flow control to keep streams open and prevent resource cleanup. This leads to memory exhaustion and denial of service.

Affected products

Cloudflare Pingora before 0.8.1

Identifiers

CVE-2026-105297
GHSA-7gpj-mj4q-x62x
RUSTSEC-2026-0389

Timeline

2026-10-20: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.