Cloudflare vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-105299 Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upsHigh 8.7 · Oct 19, 2026
• CVE-2026-105297 Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size aHigh 7.5 · Oct 19, 2026
• CVE-2026-11325 Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue High 8.8 · Aug 12, 2026
• CVE-2026-12707 Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events.High 7.5 · Jul 14, 2026
• CVE-2026-12523 Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames.High 7.5 · Jul 14, 2026
• CVE-2026-14440 Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the custHigh 7.6 · Jul 1, 2026
• CVE-2026-2836 A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction.High 8.4 · Mar 4, 2026
• CVE-2026-2835 An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests.Critical 9.3 · Mar 4, 2026
• CVE-2026-2833 An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades.Critical 9.3 · Mar 4, 2026
• CVE-2026-0933 SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command.High 7.7 · Jan 20, 2026
• CVE-2025-13353 In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM High 7.1 · Dec 2, 2025
• CVE-2025-7054 Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames.High 8.7 · Aug 7, 2025
• CVE-2025-4821 Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the patHigh 7.5 · Jun 18, 2025
• CVE-2025-6087 A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package.High 7.8 · Jun 16, 2025
• CVE-2025-4366 A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated rHigh 7.4 · May 22, 2025
• CVE-2021-3978 When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root.High 7.5 · Jan 29, 2025
• CVE-2023-7080 The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging.High 8.5 · Dec 29, 2023
• CVE-2023-7078 Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server.High 7.5 · Dec 29, 2023
• CVE-2023-4241 lol-html can cause panics on certain HTML inputs.High 7.5 · Aug 16, 2023
• CVE-2023-2754 The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a sHigh 7.4 · Aug 3, 2023
• CVE-2023-1862 Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access contHigh 7.3 · Jun 20, 2023
• CVE-2023-3036 An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3High 8.6 · Jun 14, 2023
• CVE-2023-0652 Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0)High 7 · Apr 6, 2023
• CVE-2023-1412 An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform prHigh 7 · Apr 5, 2023
• CVE-2023-1314 A vulnerability has been discovered in cloudflared's installer (<= 2023.3.0) for Windows 32-bits devices that allows a local attacker with no administrative perHigh 7.5 · Mar 21, 2023