Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

pingora-proxy

1 known vulnerability (1 high), with the versions each affects and the releases that fix them.

Latest release
0.9.1 (Nov 3, 2026): no advisory affects it
Newest unaffected release
0.9.1 (Nov 3, 2026), the latest release
Advisories
1 · 1 high
Weekly downloads
95.4K
Dependents
0
Releases
12 since 0.1.0 (Feb 28, 2024)
Registry
crates.io
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 1

  • Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments

    Affected: fixed in 0.9.0.

    Fixed in 0.9.0 (released Sep 9, 2026, 41 days before disclosure).

    The latest release, 0.9.1, is not affected.

    68% of pingora-proxy downloads in the last 90 days were affected versions (862.5K).