AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Packages

Cloudflare security advisories

36 advisories · 8 critical or high in 12 months · latest Aug 12

Advisories page

36 advisories

High 8.8Aug 12https://github.com/cloudflare/pages-action: remote code executionCVE-2026-11325no fix yetHigh 7.5Jul 14Unbounded path event queue growth via peer-driven source connection ID rotationCVE-2026-12707fixed in 0.29.3High 7.5Jul 14Resource exhaustion in HTTP/3 and QPACKCVE-2026-12523fixed in 0.29.3High 7.6Jul 1Cloudflare Universal SSL: protection mechanism failureCVE-2026-14440no fix yetMedium 5.6Jun 19Use-after-free in connection ID iterator FFI functionsCVE-2026-11941fixed in 0.29.2High 8.4Mar 5Cache poisoning via insecure-by-default cache keyCVE-2026-2836fixed in 0.8.0Critical 9.3Mar 5HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding MisparsingCVE-2026-2835fixed in 0.8.0Critical 9.3Mar 5HTTP Request Smuggling via Premature UpgradeCVE-2026-2833fixed in 0.8.0LowFeb 24Incorrect calculation in circl secp384r1 CombinedMultCVE-2026-1229fixed in 1.6.3High 7.7Jan 21OS Command Injection in `wrangler pages deploy`CVE-2026-0933fixed in 4.59.1Medium 4.8Nov 4, 2025Missing validation of redirect_uri on OAuth callback handlerGHSA-v85r-hgf6-q875fixed in upgradetoversionSHAf7c11c87ef48e9fd898b9d1ebea75078b7279728o...High 8.2Sep 17, 2025Pingora update for MadeYouReset HTTP/2 vulnerabilityCVE-2025-8671fixed in 0.6.0High 8.7Aug 7, 2025Infinite loop triggered by connection ID retirementCVE-2025-7054fixed in 0.24.5LowJul 7, 2025Cloudflare vite plugin exposes secrets over the built-in dev serverCVE-2025-59427fixed in 1.6.0High 7.4Jun 20, 2025Request Smuggling Vulnerability in PingoraCVE-2025-4366fixed in 0.5.0High 7.5Jun 17, 2025Incorrect congestion window growth by invalid ACK rangesCVE-2025-4821fixed in 0.24.4Medium 5.3Jun 17, 2025Incorrect congestion window growth by optimistic ACKCVE-2025-4820fixed in 0.24.4LowJun 10, 2025CIRCL-Fourq: Missing and wrong validation can lead to incorrect resultsGHSA-2x5j-vhc8-9cwmfixed in 1.6.1Medium 5.3May 1, 2025PKCE bypass via downgrade attackCVE-2025-4144fixed in 0.0.5Medium 6.0May 1, 2025Missing validation of redirect_uri on authorize endpointCVE-2025-4143fixed in 0.0.5Medium 5.9Mar 12, 2024Unlimited resource allocation by QUIC CRYPTO frames floodingCVE-2024-1765fixed in 0.19.2 +1Low 3.7Mar 12, 2024Unbounded storage of information related to connection ID retirement in quicheCVE-2024-1410fixed in 0.19.2 +1High 8.1Jan 29, 2024Information disclosure of Cloudflare API for low privileged usersCVE-2024-0212fixed in 4.12.3HighJan 8, 2024Kyber: timing side-channel (kyberslash2)GHSA-9763-4f94-gfchfixed in 1.3.7High 8.5Dec 29, 2023Arbitrary remote code execution within `wrangler dev` Workers sandboxCVE-2023-7080fixed in 3.19.0 +1Medium 6.9Dec 29, 2023Arbitrary remote file read in Wrangler dev serverCVE-2023-7079fixed in 3.19.0High 8.0Dec 29, 2023Server-Side Request Forgery (SSRF) in MiniflareCVE-2023-7078fixed in 3.20231030.2Medium 5.3Dec 12, 2023Unbounded queuing of path validation messages in cloudflare-quicheCVE-2023-6193fixed in 0.19.1Medium 5.3Dec 5, 2023Resource exhaustion via memory leak in tokio-boringCVE-2023-6180fixed in 4.1.0MediumNov 21, 2023WebSocket message can cause crashCVE-2023-48230fixed in v1.20231121.0High 7.5Aug 8, 2023lol-html panics on certain HTML inputsCVE-2023-4241fixed in 1.1.1Medium 5.7Aug 3, 2023Directory traversal vulnerability in Cloudflare WranglerCVE-2023-3348fixed in 3.1.1 +1Medium 6.5May 12, 2023Buffer under-read in workerdCVE-2023-2512fixed in v1.20230419.0Medium 5.3May 10, 2023Improper random reading in CIRCLCVE-2023-1732fixed in 1.3.3High 7.5Mar 21, 2023Local Privilege Escalation Vulnerability in cloudflared's InstallerCVE-2023-1314fixed in 2023.3.1MediumSep 16, 2020Local Privilege Escalation in cloudflaredCVE-2020-24356fixed in 2020.8.1
About Cloudflare

Security advisories Cloudflare publishes for its own products.

hackerone.com/cloudflare/hacktivityCloudflare

Cloudflare elsewhere on Ibis: Acquisitions · Quarterly · Paydays · Releases · Repos · TechConf · Trending