CVE-2026-105299 - Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
CVE ID :CVE-2026-105299 Published : Oct. 20, 2026, 1:07 a.m. | 58 minutes ago Description :Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's...