https://github.com/cloudflare/pingora

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding MisparsingCVE-2026-2835Cloudflare · CVSS 9.3 · 0.9% likelycovered by CyberSIXT

   CWE-444

2. HTTP Request Smuggling via Premature UpgradeCVE-2026-2833Cloudflare · CVSS 9.3 · 0.7% likelycovered by CyberSIXT

   CWE-444

3. Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypassCVE-2026-105298Cloudflare · CVSS 6.3 · 0.6% likely

   CWE-444

4. Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limitsCVE-2026-105297Cloudflare · CVSS 7.5 · 0.4% likely

   CWE-770

5. Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deploymentsCVE-2026-105299Cloudflare · CVSS 8.7 · 0.4% likely

   CWE-444

6. Cache poisoning via insecure-by-default cache keyCVE-2026-2836Cloudflare · CVSS 8.4 · 0.4% likelycovered by CyberSIXT

   CWE-345

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.