Pingora’s HTTP/2 server defaulted to 16 MiB decoded header-list size and no limit on concurrent streams before version 0.8.1, allowing a remote client to send minimal HPACK references that trigger the allocation of hundreds of thousands of header fields per stream. With HTTP/2 flow control keeping the streams open, an attacker can exhaust server memory and force the process to OOM‑kill. The vulnerability results in denial of service for any Pingora instance that does not explicitly set max_header_list_size and max_concurrent_streams. This can compromise confidentiality, integrity, and availability of services exposed via HTTP/2 (h2 or h2c).

Cloudflare’s Pingora HTTP/2 server library, versions preceding 0.8.1, or any application that incorporates Pingora without configuring the H2Options limits. Cloudflare CDN customers are unaffected because internal services that use Pingora do not accept HTTP/2 connections from clients.

The CVSS score of 7.5 classifies the weakness as high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, indicating no publicly confirmed exploitation yet. The likely attack vector is an unauthenticated remote client that initiates an HTTP/2 connection to a Pingora‑powered service. Exploitation requires no privileged access or prior credentials and can be performed by sending a crafted stream of small HPACK references to trigger memory allocation. Once the memory threshold is reached, the process crashes, resulting in a denial of service.