Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

pingora-core

6 known vulnerabilities (2 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
0.9.1 (Nov 3, 2026): no advisory affects it
Newest unaffected release
0.9.1 (Nov 3, 2026), the latest release
Advisories
6 · 2 critical, 3 high, 1 medium
Weekly downloads
97.6K
Dependents
0
Releases
12 since 0.1.0 (Feb 28, 2024)
Registry
crates.io
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • CVE-2026-105298Medium 6.3

    Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

    Affected: fixed in 0.9.0.

    Fixed in 0.9.0 (released Sep 9, 2026, 41 days before disclosure).

    The latest release, 0.9.1, is not affected.

    68% of pingora-core downloads in the last 90 days were affected versions (888.9K).

  • Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits

    Affected: fixed in 0.8.1.

    Fixed in 0.8.1 (released Jun 4, 2026, 138 days before disclosure).

    The latest release, 0.9.1, is not affected.

    35% of pingora-core downloads in the last 90 days were affected versions (460.7K).

  • CVE-2026-2835Critical 9.3

    HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

    Affected: fixed in 0.8.0; fixed in 0.8.0.

    Fixed in 0.8.0 (released Mar 2, 2026, 2 days before disclosure).

    The latest release, 0.9.1, is not affected.

    20% of pingora-core downloads in the last 90 days were affected versions (262.8K).

  • CVE-2026-2833Critical 9.3

    HTTP Request Smuggling via Premature Upgrade

    Affected: fixed in 0.8.0; fixed in 0.8.0.

    Fixed in 0.8.0 (released Mar 2, 2026, 2 days before disclosure).

    The latest release, 0.9.1, is not affected.

    20% of pingora-core downloads in the last 90 days were affected versions (262.8K).

  • CVE-2025-8671

    Affected: fixed in 0.6.0.

    Fixed in 0.6.0 (released Aug 15, 2025, 2 days after disclosure).

    The latest release, 0.9.1, is not affected.

  • Request Smuggling Vulnerability in Pingora

    Affected: fixed in 0.5.0; fixed in 0.5.0.

    Fixed in 0.5.0 (released May 9, 2025, 13 days before disclosure).

    The latest release, 0.9.1, is not affected.