Cloudflare security advisories

Date	Advisory	Product	Severity	Fixed in
Aug 12	https://github.com/cloudflare/pages-action: remote code execution https://github.com/cloudflare/pages-actionHigh8.8Aug 12 CVE-2026-11325https://github.com/cloudflare/pages-actionNo fix yet	https://github.com/cloudflare/pages-action	High8.8	No fix yet
Jul 14	Unbounded path event queue growth via peer-driven source connection ID rotation CloudflareHigh7.5Jul 14 CVE-2026-12707Cloudflare0.29.3	Cloudflare	High7.5	0.29.3
Jul 14	Resource exhaustion in HTTP/3 and QPACK CloudflareHigh7.5Jul 14 CVE-2026-12523Cloudflare0.29.3	Cloudflare	High7.5	0.29.3
Jul 1	Cloudflare Universal SSL: protection mechanism failure Universal SSLHigh7.6Jul 1 CVE-2026-14440Universal SSLNo fix yet	Universal SSL	High7.6	No fix yet
Jun 19	Use-after-free in connection ID iterator FFI functions CloudflareMedium5.6Jun 19 CVE-2026-11941Cloudflare0.29.2	Cloudflare	Medium5.6	0.29.2
Mar 5	Cache poisoning via insecure-by-default cache key CloudflareHigh8.4Mar 5 CVE-2026-2836Cloudflare0.8.0	Cloudflare	High8.4	0.8.0
Mar 5	HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing CloudflareCritical9.3Mar 5 CVE-2026-2835Cloudflare0.8.0	Cloudflare	Critical9.3	0.8.0
Mar 5	HTTP Request Smuggling via Premature Upgrade CloudflareCritical9.3Mar 5 CVE-2026-2833Cloudflare0.8.0	Cloudflare	Critical9.3	0.8.0
Feb 24	Incorrect calculation in circl secp384r1 CombinedMult CloudflareLowFeb 24 CVE-2026-1229Cloudflare1.6.3	Cloudflare	Low	1.6.3
Feb 13	Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site agentsMediumFeb 13 GHSA-w5cr-2qhr-jqc5agents0.3.10	agents	Medium	0.3.10
Feb 13	agents: cross-site scripting agentsMediumFeb 13 CVE-2026-1721agents0.3.10	agents	Medium	0.3.10
Feb 3	Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing agentsMediumFeb 3 CVE-2026-1664agents0.3.7	agents	Medium	0.3.7
Jan 21	OS Command Injection in `wrangler pages deploy` CloudflareHigh7.7Jan 21 CVE-2026-0933Cloudflare4.59.1	Cloudflare	High7.7	4.59.1
Nov 42025	Missing validation of redirect_uri on OAuth callback handler CloudflareMedium4.8Nov 4, 2025 GHSA-v85r-hgf6-q875CloudflareupgradetoversionSHAf7c11c87ef48e9fd898b9d1ebea75078b7279728o...	Cloudflare	Medium4.8	upgradetoversionSHAf7c11c87ef48e9fd898b9d1ebea75078b7279728o...
Sep 172025	Pingora update for MadeYouReset HTTP/2 vulnerability CloudflareHigh8.2Sep 17, 2025 CVE-2025-8671Cloudflare0.6.0	Cloudflare	High8.2	0.6.0
Aug 72025	Infinite loop triggered by connection ID retirement CloudflareHigh8.7Aug 7, 2025 CVE-2025-7054Cloudflare0.24.5	Cloudflare	High8.7	0.24.5
Jul 72025	Cloudflare vite plugin exposes secrets over the built-in dev server CloudflareLowJul 7, 2025 CVE-2025-59427Cloudflare1.6.0	Cloudflare	Low	1.6.0
Jun 202025	Request Smuggling Vulnerability in Pingora CloudflareHigh7.4Jun 20, 2025 CVE-2025-4366Cloudflare0.5.0	Cloudflare	High7.4	0.5.0
Jun 172025	Incorrect congestion window growth by invalid ACK ranges CloudflareHigh7.5Jun 17, 2025 CVE-2025-4821Cloudflare0.24.4	Cloudflare	High7.5	0.24.4
Jun 172025	Incorrect congestion window growth by optimistic ACK CloudflareMedium5.3Jun 17, 2025 CVE-2025-4820Cloudflare0.24.4	Cloudflare	Medium5.3	0.24.4
Jun 102025	CIRCL-Fourq: Missing and wrong validation can lead to incorrect results CloudflareLowJun 10, 2025 GHSA-2x5j-vhc8-9cwmCloudflare1.6.1	Cloudflare	Low	1.6.1
May 12025	PKCE bypass via downgrade attack CloudflareMedium5.3May 1, 2025 CVE-2025-4144Cloudflare0.0.5	Cloudflare	Medium5.3	0.0.5
May 12025	Missing validation of redirect_uri on authorize endpoint CloudflareMedium6.0May 1, 2025 CVE-2025-4143Cloudflare0.0.5	Cloudflare	Medium6.0	0.0.5
Mar 122024	Unlimited resource allocation by QUIC CRYPTO frames flooding CloudflareMedium5.9Mar 12, 2024 CVE-2024-1765Cloudflare0.19.2+1 more	Cloudflare	Medium5.9	0.19.2+1 more
Mar 122024	Unbounded storage of information related to connection ID retirement in quiche CloudflareLow3.7Mar 12, 2024 CVE-2024-1410Cloudflare0.19.2+1 more	Cloudflare	Low3.7	0.19.2+1 more
Jan 292024	Information disclosure of Cloudflare API for low privileged users CloudflareHigh8.1Jan 29, 2024 CVE-2024-0212Cloudflare4.12.3	Cloudflare	High8.1	4.12.3
Jan 82024	Kyber: timing side-channel (kyberslash2) CloudflareHighJan 8, 2024 GHSA-9763-4f94-gfchCloudflare1.3.7	Cloudflare	High	1.3.7
Dec 292023	Arbitrary remote code execution within `wrangler dev` Workers sandbox CloudflareHigh8.5Dec 29, 2023 CVE-2023-7080Cloudflare3.19.0+1 more	Cloudflare	High8.5	3.19.0+1 more
Dec 292023	Arbitrary remote file read in Wrangler dev server CloudflareMedium6.9Dec 29, 2023 CVE-2023-7079Cloudflare3.19.0	Cloudflare	Medium6.9	3.19.0
Dec 292023	Server-Side Request Forgery (SSRF) in Miniflare CloudflareHigh8.0Dec 29, 2023 CVE-2023-7078Cloudflare3.20231030.2	Cloudflare	High8.0	3.20231030.2
Dec 122023	Unbounded queuing of path validation messages in cloudflare-quiche CloudflareMedium5.3Dec 12, 2023 CVE-2023-6193Cloudflare0.19.1	Cloudflare	Medium5.3	0.19.1
Dec 52023	Resource exhaustion via memory leak in tokio-boring CloudflareMedium5.3Dec 5, 2023 CVE-2023-6180Cloudflare4.1.0	Cloudflare	Medium5.3	4.1.0
Nov 212023	WebSocket message can cause crash CloudflareMediumNov 21, 2023 CVE-2023-48230Cloudflarev1.20231121.0	Cloudflare	Medium	v1.20231121.0
Aug 32023	Directory traversal vulnerability in Cloudflare Wrangler CloudflareMedium5.7Aug 3, 2023 CVE-2023-3348Cloudflare3.1.1+1 more	Cloudflare	Medium5.7	3.1.1+1 more
May 122023	Buffer under-read in workerd CloudflareMedium6.5May 12, 2023 CVE-2023-2512Cloudflarev1.20230419.0	Cloudflare	Medium6.5	v1.20230419.0
May 102023	Improper random reading in CIRCL CloudflareMedium5.3May 10, 2023 CVE-2023-1732Cloudflare1.3.3	Cloudflare	Medium5.3	1.3.3
Mar 212023	Local Privilege Escalation Vulnerability in cloudflared's Installer CloudflareHigh7.5Mar 21, 2023 CVE-2023-1314Cloudflare2023.3.1	Cloudflare	High7.5	2023.3.1
Sep 162020	Local Privilege Escalation in cloudflared CloudflareMediumSep 16, 2020 CVE-2020-24356Cloudflare2020.8.1	Cloudflare	Medium	2020.8.1

About Cloudflare

Cloudflare, Inc., is an American technology company headquartered in San Francisco, California, that provides a range of internet services, including content delivery network (CDN) services, cloud cybersecurity, DDoS mitigation, and ICANN-accredited domain registration.

Elsewhere on fru.dev: Quarterly · Paydays · Releases · Repos · TechConf · Trending

Critical advisories by email