CVE-2026-105298: Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
Summary
Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.reqheader().uri) saw the :authority value, but the upstream received the client-supplied Host value. Pingora also accepted :authority values containing userinfo (for example, user@example.com). This violates RFC 9113 Section 8.3.1, which requires an intermediary to use the :authority value for Host and replace any existing Host field.
Root cause
HTTP/2 to HTTP/1.1: Host was generated from :authority only when the request had no Host header, so a conflicting client Host was forwarded unchanged.
HTTP/2 to HTTP/2: the client Host header was removed and used to overwrite the upstream :authority, after request filters had already run against the original :authority.
The HTTP/2 server did not compare Host with :authority and did not reject userinfo in the authority.
Impact
A remote, unauthenticated attacker can send a single HTTP/2 request that the application sees as one host and the upstream receives as another. Where request filters, access controls, or cache keys use the URI authority and the upstream routes by Host, this can lead to:
Cache poisoning: a response from another virtual host is stored under the victim host's cache key and served to other users (this also requires the upstream to serve different content per Host).
Host-based access control bypass: a request approved for one host is served by a different virtual host on the upstream.
Deployments that do not accept HTTP/2 from clients, or that do not use the request authority for security or caching decisions, are not affected.
Note that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.
Mitigation:
Upgrade to pingora 0.9.0 or later. Pingora now returns 400 Bad Request for HTTP/2 requests whose Host differs from :authority, that contain more than one Host, or whose authority contains userinfo, and keeps the upstream Host or :authority consistent with the request authority. Fix commits: https://github.com/cloudflare/pingora/commit/915590a91811877795531f6ba0927a3138b5cb4b , https://github.com/cloudflare/pingora/commit/ffab8302d08d4292d1924eb8fe84647fd5cb8e76
If you cannot upgrade: in requestfilter, reject HTTP/2 requests that carry a Host header different from the URI authority, or whose authority contains '@'.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pingorato a version that resolves this vulnerability.Fixed in 0.9.0 - Compensating control
In request_filter, reject HTTP/2 requests that carry a Host header different from the URI authority or whose authority contains '@'.
Event History
Frequently Asked Questions
Which deployments are most exposed to meaningful impact?
Deployments are most exposed when request filters, host-based access controls, cache keys, or logging use the request URI while the upstream application makes decisions based on the Host header it receives. In those configurations, the two layers can evaluate different hostnames for the same request.
What does an attacker need to exploit this behavior?
A remote, unauthenticated attacker only needs to send a single HTTP/2 request with a Host header that differs from the :authority pseudo-header. The server also accepted :authority values containing userinfo, such as user@example.com.
How does the conflicting host value reach an upstream service?
For HTTP/2-to-HTTP/1.1 forwarding, Pingora generated Host from :authority only when the request lacked a Host header, allowing a supplied conflicting Host header to be forwarded. For HTTP/2-to-HTTP/2 forwarding, Pingora removed the client Host header and used it to overwrite the upstream :authority after request filters had run.
Which versions require remediation?
Versions before 0.9.0 are affected. Version 0.9.0 is the stated boundary for the corrected behavior.
Can request logs reveal suspicious activity?
Logs that read the request URI record the :authority value, while the upstream may have received the client-supplied Host value. As a result, URI-based logs alone may not reflect the hostname used by the upstream service.