Cloudflare security advisories

35 advisories · 8 critical or high in 12 months · latest Aug 12

35 advisories

Date	Advisory	Severity	Fixed in
Aug 12	https://github.com/cloudflare/pages-action: remote code execution High8.8Aug 12 CVE-2026-11325No fix yet	High8.8	No fix yet
Jul 14	Unbounded path event queue growth via peer-driven source connection ID rotation High7.5Jul 14 CVE-2026-127070.29.3	High7.5	0.29.3
Jul 14	Resource exhaustion in HTTP/3 and QPACK High7.5Jul 14 CVE-2026-125230.29.3	High7.5	0.29.3
Jul 1	Cloudflare Universal SSL: protection mechanism failure High7.6Jul 1 CVE-2026-14440No fix yet	High7.6	No fix yet
Jun 19	Use-after-free in connection ID iterator FFI functions Medium5.6Jun 19 CVE-2026-119410.29.2	Medium5.6	0.29.2
Mar 5	Cache poisoning via insecure-by-default cache key High8.4Mar 5 CVE-2026-28360.8.0	High8.4	0.8.0
Mar 5	HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing Critical9.3Mar 5 CVE-2026-28350.8.0	Critical9.3	0.8.0
Mar 5	HTTP Request Smuggling via Premature Upgrade Critical9.3Mar 5 CVE-2026-28330.8.0	Critical9.3	0.8.0
Feb 24	Incorrect calculation in circl secp384r1 CombinedMult LowFeb 24 CVE-2026-12291.6.3	Low	1.6.3
Jan 21	OS Command Injection in `wrangler pages deploy` High7.7Jan 21 CVE-2026-09334.59.1	High7.7	4.59.1
Nov 42025	Missing validation of redirect_uri on OAuth callback handler Medium4.8Nov 4, 2025 GHSA-v85r-hgf6-q875upgradetoversionSHAf7c11c87ef48e9fd898b9d1ebea75078b7279728o...	Medium4.8	upgradetoversionSHAf7c11c87ef48e9fd898b9d1ebea75078b7279728o...
Sep 172025	Pingora update for MadeYouReset HTTP/2 vulnerability High8.2Sep 17, 2025 CVE-2025-86710.6.0	High8.2	0.6.0
Aug 72025	Infinite loop triggered by connection ID retirement High8.7Aug 7, 2025 CVE-2025-70540.24.5	High8.7	0.24.5
Jul 72025	Cloudflare vite plugin exposes secrets over the built-in dev server LowJul 7, 2025 CVE-2025-594271.6.0	Low	1.6.0
Jun 202025	Request Smuggling Vulnerability in Pingora High7.4Jun 20, 2025 CVE-2025-43660.5.0	High7.4	0.5.0
Jun 172025	Incorrect congestion window growth by invalid ACK ranges High7.5Jun 17, 2025 CVE-2025-48210.24.4	High7.5	0.24.4
Jun 172025	Incorrect congestion window growth by optimistic ACK Medium5.3Jun 17, 2025 CVE-2025-48200.24.4	Medium5.3	0.24.4
Jun 102025	CIRCL-Fourq: Missing and wrong validation can lead to incorrect results LowJun 10, 2025 GHSA-2x5j-vhc8-9cwm1.6.1	Low	1.6.1
May 12025	PKCE bypass via downgrade attack Medium5.3May 1, 2025 CVE-2025-41440.0.5	Medium5.3	0.0.5
May 12025	Missing validation of redirect_uri on authorize endpoint Medium6.0May 1, 2025 CVE-2025-41430.0.5	Medium6.0	0.0.5
Mar 122024	Unlimited resource allocation by QUIC CRYPTO frames flooding Medium5.9Mar 12, 2024 CVE-2024-17650.19.2+1 more	Medium5.9	0.19.2+1 more
Mar 122024	Unbounded storage of information related to connection ID retirement in quiche Low3.7Mar 12, 2024 CVE-2024-14100.19.2+1 more	Low3.7	0.19.2+1 more
Jan 292024	Information disclosure of Cloudflare API for low privileged users High8.1Jan 29, 2024 CVE-2024-02124.12.3	High8.1	4.12.3
Jan 82024	Kyber: timing side-channel (kyberslash2) HighJan 8, 2024 GHSA-9763-4f94-gfch1.3.7	High	1.3.7
Dec 292023	Arbitrary remote code execution within `wrangler dev` Workers sandbox High8.5Dec 29, 2023 CVE-2023-70803.19.0+1 more	High8.5	3.19.0+1 more
Dec 292023	Arbitrary remote file read in Wrangler dev server Medium6.9Dec 29, 2023 CVE-2023-70793.19.0	Medium6.9	3.19.0
Dec 292023	Server-Side Request Forgery (SSRF) in Miniflare High8.0Dec 29, 2023 CVE-2023-70783.20231030.2	High8.0	3.20231030.2
Dec 122023	Unbounded queuing of path validation messages in cloudflare-quiche Medium5.3Dec 12, 2023 CVE-2023-61930.19.1	Medium5.3	0.19.1
Dec 52023	Resource exhaustion via memory leak in tokio-boring Medium5.3Dec 5, 2023 CVE-2023-61804.1.0	Medium5.3	4.1.0
Nov 212023	WebSocket message can cause crash MediumNov 21, 2023 CVE-2023-48230v1.20231121.0	Medium	v1.20231121.0
Aug 32023	Directory traversal vulnerability in Cloudflare Wrangler Medium5.7Aug 3, 2023 CVE-2023-33483.1.1+1 more	Medium5.7	3.1.1+1 more
May 122023	Buffer under-read in workerd Medium6.5May 12, 2023 CVE-2023-2512v1.20230419.0	Medium6.5	v1.20230419.0
May 102023	Improper random reading in CIRCL Medium5.3May 10, 2023 CVE-2023-17321.3.3	Medium5.3	1.3.3
Mar 212023	Local Privilege Escalation Vulnerability in cloudflared's Installer High7.5Mar 21, 2023 CVE-2023-13142023.3.1	High7.5	2023.3.1
Sep 162020	Local Privilege Escalation in cloudflared MediumSep 16, 2020 CVE-2020-243562020.8.1	Medium	2020.8.1

About Cloudflare

Security advisories Cloudflare publishes for its own products.

hackerone.com/cloudflare/hacktivity Cloudflare

Cloudflare elsewhere on fru.dev: Quarterly · Paydays · Releases · Repos · TechConf · Trending

Critical advisories by email