Cloudflare
Cloudflare Security Releases - October 2026
cloudflare-2026-10 Oct 1, 2026 Source: Vendor
Cloudflare security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-105297
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
2 lines
Showing 1–2 of 2
CVE-2026-105297
BR2026-0000-041442
https://github.com/cloudflare/pingora
unclaimed
Summary
Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A ...
Credited as jro-calif (GitHub)
CVE-2026-105298
BR2026-0000-041443
https://github.com/cloudflare/pingora
unclaimed
Summary
Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (sess...
Credited as bipol4r (GitHub)