Cloudflare vulnerabilities

Products

• Warp 19
• Octorpki 9
• Quiche 9
• Https://github.com/cloudflare/pingora 6
• Pingora 4
• Warp Client 4
• Wrangler 4
• Warp Mobile Client 3
• Circl 2
• Cloudflared 2
• Workers-oauth-provider 2

Newest

• cloudflare https://github.com/cloudflare/pingora Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments CVE-2026-105299 Fix available 8.7 HighOctober 20, 2026
• cloudflare https://github.com/cloudflare/pingora Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass CVE-2026-105298 Fix available 6.3 MediumOctober 20, 2026
• cloudflare https://github.com/cloudflare/pingora Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits CVE-2026-105297 Fix available 7.5 HighOctober 20, 2026
• cloudflare https://github.com/cloudflare/pages-action cloudflare/pages-action is deprecated — migration required by September 18th, 2026 CVE-2026-11325 8.8 HighAugust 12, 2026
• cloudflare quiche Resource exhaustion in quiche HTTP/3 and QPACK layers CVE-2026-12523 Public exploit 7.5 HighJuly 14, 2026
• cloudflare quiche Unbounded path event queue growth in quiche via peer-driven source connection ID rotation CVE-2026-12707 7.5 HighJuly 14, 2026
• cloudflare universal ssl Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records CVE-2026-14440 Public exploit 7.6 HighJuly 1, 2026
• cloudflare quiche Use-after-free in connection ID iterator and FFI functions CVE-2026-11941 Fix available 5.6 MediumJune 19, 2026
• cloudflare pingora, https://github.com/cloudflare/pingora +1 more Cache poisoning via insecure-by-default cache key CVE-2026-2836 Fix available 8.4 HighMarch 4, 2026
• cloudflare pingora, https://github.com/cloudflare/pingora +1 more HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing CVE-2026-2835 Fix available 9.3 CriticalMarch 4, 2026
• cloudflare pingora, https://github.com/cloudflare/pingora +1 more HTTP Request Smuggling via Premature Upgrade CVE-2026-2833 Fix available 9.3 CriticalMarch 4, 2026
• cloudflare circl Incorrect calculation in CIRCL secp384r1 CombinedMult CVE-2026-1229 Fix available 2.9 LowFebruary 24, 2026
• cloudflare wrangler OS Command Injection in `wrangler pages deploy` CVE-2026-0933 Fix available 7.7 HighJanuary 20, 2026
• cloudflare gokey gokey allows secret recovery from a seed file without the master password CVE-2025-13353 Fix available 7.1 HighDecember 2, 2025
• cloudflare quiche Infinite loop triggered by connection ID retirement CVE-2025-7054 Fix available 8.7 HighAugust 7, 2025
• cloudflare workers-sdk Cloudflare vite plugin exposes secrets over the built-in dev server CVE-2025-59427 Fix available 2.9 LowJuly 8, 2025
• cloudflare quiche Incorrect congestion window growth by invalid ACK ranges CVE-2025-4821 Fix available 7.5 HighJune 18, 2025
• cloudflare quiche Incorrect congestion window growth by optimistic ACK CVE-2025-4820 Fix available 5.3 MediumJune 18, 2025
• cloudflare create-cloudflare, opennextjs opennext for cloudflare +1 more SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint CVE-2025-6087 Fix available 7.8 HighJune 16, 2025
• cloudflare pingora Request Smuggling Vulnerability in Pingora CVE-2025-4366 Fix available 7.4 HighMay 22, 2025
• cloudflare workers-oauth-provider PKCE bypass via downgrade attack CVE-2025-4144 Fix available 5.3 MediumMay 1, 2025
• cloudflare workers-oauth-provider Missing validation of redirect_uri on authorize endpoint CVE-2025-4143 Fix available 6.0 MediumMay 1, 2025
• cloudflare warp File symlink abuse might lead to deleting files belonging to SYSTEM user CVE-2025-0651 Public exploit 6.1 MediumJanuary 22, 2025
• cloudflare quiche Unbounded storage of information related to connection ID retirement, in quiche CVE-2024-1410 Fix available 3.7 LowMarch 12, 2024
• cloudflare quiche Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche CVE-2024-1765 Fix available 5.9 MediumMarch 12, 2024
• cloudflare, cloudflare cloudflare-wordpress +1 more Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users) CVE-2024-0212 8.1 HighJanuary 29, 2024
• cloudflare zlib Memory corruption issues is Cloudflare zlib implementation CVE-2023-6992 Fix available 4.0 MediumJanuary 4, 2024
• cloudflare wrangler Arbitrary remote code execution within wrangler dev Workers sandbox CVE-2023-7080 Fix available 8.5 HighDecember 29, 2023
• cloudflare wrangler Arbitrary remote file read in Wrangler dev server CVE-2023-7079 Fix available 6.4 MediumDecember 29, 2023
• cloudflare miniflare Server-Side Request Forgery (SSRF) in Miniflare CVE-2023-7078 Fix available 7.5 HighDecember 29, 2023
• cloudflare quiche Unbounded queuing of path validation messages in cloudflare-quiche CVE-2023-6193 Fix available 5.3 MediumDecember 12, 2023
• cloudflare boring, tokio-boring +1 more Resource exhaustion via memory leak in tokio-boring CVE-2023-6180 Fix available 5.3 MediumDecember 5, 2023
• cloudflare warp, warp client +1 more Insufficient Validation on Override Codes for Always-Enabled WARP Mode CVE-2023-3747 5.5 MediumSeptember 7, 2023
• cloudflare warp, warp client +1 more Spoofing User's Activity Loads in WARP Mobile Client (Android) CVE-2023-0654 3.9 LowAugust 29, 2023
• cloudflare warp, warp client +1 more Injecting Activity Loads in WARP Mobile Client CVE-2023-0238 3.9 LowAugust 29, 2023
• cloudflare lol-html lol-html panics on certain HTML inputs CVE-2023-4241 Fix available 7.5 HighAugust 9, 2023
• cloudflare warp Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client CVE-2023-2754 7.4 HighAugust 3, 2023
• cloudflare wrangler Directory traversal vulnerability in Cloudflare Wrangler CVE-2023-3348 Fix available 5.7 MediumAugust 3, 2023
• cloudflare odoh-rs Invalid Slice Split Results in Server Panic CVE-2023-3766 Fix available 5.9 MediumAugust 3, 2023
• cloudflare warp, warp client +1 more Remote access to warp-svc.exe in Cloudflare WARP CVE-2023-1862 7.3 HighJune 20, 2023
• cloudflare lua-resty-json Out of Bounds Access Leading to Undefined Behavior CVE-2023-3040 3.7 LowJune 14, 2023
• cloudflare cfnts Out of Bounds Slice index in cfnts leads to remote panic CVE-2023-3036 8.6 HighJune 14, 2023
• cloudflare workerd Buffer under-read in workerd CVE-2023-2512 Fix available 6.5 MediumMay 12, 2023
• cloudflare circl Improper random reading in CIRCL CVE-2023-1732 Fix available 5.3 MediumMay 10, 2023
• cloudflare warp Local Privilege Escalation in Cloudflare WARP Installer (Windows) CVE-2023-0652 7.0 HighApril 6, 2023
• cloudflare warp Local Privilege Escalation Vulnerability in WARP's MSI Installer CVE-2023-1412 7.0 HighApril 5, 2023
• cloudflare cloudflared Local Privilege Escalation Vulnerability in cloudflared's Installer CVE-2023-1314 Fix available 7.5 HighMarch 21, 2023
• cloudflare warp support_uri validation missing in WARP client for Windows CVE-2022-4428 8.9 HighJanuary 11, 2023
• cloudflare warp WARP client manifest misconfiguration leading to Task Hijacking CVE-2022-4457 5.5 MediumJanuary 11, 2023
• cloudflare warp Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command CVE-2022-3320 6.7 MediumOctober 28, 2022
• Show olderLoading…