{"id":"GHSA-393w-9x6h-8gc7","aliases":[],"url":"https://o3.security/vulnerability/GHSA-393w-9x6h-8gc7","summary":"Pingora update for MadeYouReset HTTP/2 vulnerability","details":"Pingora deployments that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed by the server. Repeated resets can force excessive memory consumption and lead to denial-of-service.\n\n**Impact**:\nOn affected versions, malicious clients could trigger unusually high memory consumption, which may result in service instability or process termination.\n\n**Credits**:\nReported responsibly by security researcher [Gal Bar Nahum](https://github.com/galbarnahum) (@[galbarnahum](https://github.com/galbarnahum))\n\n**Mitigation**:\nThis issue is addressed by ensuring Pingora uses patched versions of HTTP/2 dependencies that include reset-handling safeguards to release connection resources before excessive memory buildup. Users should upgrade to the latest Pingora release, which incorporates the required fixes.\n- Users are requested to upgrade to latest version of Pingora >= 0.6.0","published":"2025-09-17T20:46:50Z","modified":"2025-09-17T20:46:50Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"pingora-core","fixedVersion":"0.6.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/cloudflare/pingora/security/advisories/GHSA-393w-9x6h-8gc7"},{"type":"PACKAGE","url":"https://github.com/cloudflare/pingora"},{"type":"WEB","url":"https://github.com/cloudflare/pingora/releases/tag/0.6.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-09-17T20:46:50Z"}}