Pingora versions prior to 0.9.0 accepted HTTP/2 requests in which the Host header differed from the :authority pseudo‑header, and also allowed :authority values that included userinfo. The server did not compare the two values or reject userinfo, resulting in the upstream receiving a Host that did not match the one seen by request filters, logs, or cache keys. An unauthenticated attacker can therefore send a single crafted HTTP/2 request that the application interprets as belonging to one host while the upstream treats it as another. This mismatch can lead to cache poisoning, where a response from another virtual host is stored under an incorrect cache key, and to host‑based access control bypass, where an access‑controlled request for one host is served by a different host.

The affected product is Cloudflare’s Pingora reverse‑proxy server version 0.8.x and earlier. Any deployment running Pingora 0.8.x or earlier with HTTP/2 client support enabled is vulnerable; upgrades to version 0.9.0 or later contain the necessary fixes.

The CVSS score of 6.3 indicates moderate impact, and the EPSS score is less than 1%, showing a low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the flaw is exploitable remotely by an unauthenticated attacker who can craft standard HTTP/2 traffic to induce the Host/authority mismatch. Once exploited, the attacker can poison cache entries or bypass host‑based access controls without requiring elevated privileges.