GHSA-393w-9x6h-8gc7
Pingora update for MadeYouReset HTTP/2 vulnerability
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.6.0- Upgrade pingora-core to this version or later
Description
Pingora deployments that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed by the server. Repeated resets can force excessive memory consumption and lead to denial-of-service.
Impact: On affected versions, malicious clients could trigger unusually high memory consumption, which may result in service instability or process termination.
Credits: Reported responsibly by security researcher Gal Bar Nahum (@galbarnahum)
Mitigation: This issue is addressed by ensuring Pingora uses patched versions of HTTP/2 dependencies that include reset-handling safeguards to release connection resources before excessive memory buildup. Users should upgrade to the latest Pingora release, which incorporates the required fixes.
- Users are requested to upgrade to latest version of Pingora >= 0.6.0
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| pingora-core | < 0.6.0 |
0.6.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pingora-core crates.io → 0.6.0
- cargo
cargo update -p pingora-core --precise 0.6.0
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- Low
References
Packages
Other links
Timeline
- Published
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0388 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass | Not rated yet | Also affects pingora-core |
| RUSTSEC-2026-0389 Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits | High | Also affects pingora-core |
| GHSA-xq2h-p299-vjwv Pingora vulnerable to HTTP Request Smuggling via Premature Upgrade | Critical | Also affects pingora-core |
| GHSA-hj7x-879w-vrp7 Pingora has HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing | Critical | Also affects pingora-core |
| RUSTSEC-2025-0070 Pingora MadeYouReset HTTP/2 vulnerability | High | Also affects pingora-core |
| GHSA-93c7-7xqw-w357 Pingora has a Request Smuggling Vulnerability | Medium | Also affects pingora-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor