Cloudflare
57 CVEs across 30 Cloudflare products. Browse Cloudflare vulnerabilities, severities, and proof-of-concept exploits.
Cloudflare products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11325 | High | 8.8 | 2026-08-12 | Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue… |
CVE-2026-12707 | High | 7.5 | 2026-07-14 | Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. … |
CVE-2026-12523 | High | 7.5 | 2026-07-14 | Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. … |
CVE-2026-14440 | Medium | 6.8 | 2026-07-01 | Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the cus… |
CVE-2026-11941 | Medium | 5.6 | 2026-06-19 | Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The “quiche_connection_id_iter_next” and “qu… |
CVE-2026-2836 | High | 8.1 | 2026-03-05 | A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP… |
CVE-2026-2835 | Critical | 9.1 | 2026-03-05 | An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to impro… |
CVE-2026-2833 | Critical | 9.1 | 2026-03-05 | An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads… |
CVE-2026-1229 | Critical | 9.8 | 2026-02-24 | The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete… |
CVE-2026-0933 | Critical | 9.9 | 2026-01-20 | SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash`… |
CVE-2025-13353 | Medium | 5.5 | 2025-12-02 | In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM… |
CVE-2025-59427 | | 2025-09-19 | The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default c… | |
CVE-2025-7054 | Medium | 6.5 | 2025-08-07 | Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames. QUIC connections possess a… |
CVE-2025-4821 | High | 7.5 | 2025-06-18 | Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the pa… |
CVE-2025-4820 | Medium | 5.3 | 2025-06-18 | Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the pa… |
CVE-2025-6087 | Critical | 9.1 | 2025-06-16 | A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature… |
CVE-2025-4366 | Medium | 6.1 | 2025-05-22 | A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated… |
CVE-2025-4144 | Critical | 9.8 | 2025-05-01 | PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However… |
CVE-2025-4143 | Medium | 6.1 | 2025-05-01 | The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that r… |
CVE-2021-3978 | High | 7.5 | 2025-01-29 | When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service def… |
CVE-2025-0651 | High | 7.1 | 2025-01-22 | Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges can create a set of sym… |
CVE-2024-1765 | Medium | 5.9 | 2024-03-12 | Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the… |
CVE-2024-1410 | Low | 3.7 | 2024-03-12 | Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resour… |
CVE-2024-0212 | High | 8.1 | 2024-01-29 | The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to a… |
CVE-2023-6992 | Medium | 4.0 | 2024-01-04 | Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The iss… |
CVE-2023-7080 | High | 8.5 | 2023-12-29 | The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector serve… |
CVE-2023-7079 | Medium | 6.4 | 2023-12-29 | Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over t… |
CVE-2023-7078 | High | 7.5 | 2023-12-29 | Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare wa… |
CVE-2023-6193 | Medium | 5.3 | 2023-12-12 | quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consum… |
CVE-2023-6180 | Medium | 5.3 | 2023-12-05 | The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exha… |
CVE-2023-3747 | Medium | 5.5 | 2023-09-07 | Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators… |
CVE-2023-0654 | Low | 3.9 | 2023-08-29 | Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious… |
CVE-2023-0238 | Low | 3.9 | 2023-08-29 | Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on… |
CVE-2023-4241 | High | 7.5 | 2023-08-16 | lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected. |
CVE-2023-3766 | Medium | 5.9 | 2023-08-03 | A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs w… |
CVE-2023-3348 | Medium | 5.7 | 2023-08-03 | The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development se… |
CVE-2023-2754 | High | 7.4 | 2023-08-03 | The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a… |
CVE-2023-1862 | High | 7.3 | 2023-06-20 | Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access con… |
CVE-2023-3040 | Low | 3.7 | 2023-06-14 | A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access b… |
CVE-2023-3036 | High | 8.6 | 2023-06-14 | An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e… |
CVE-2023-2512 | Medium | 6.5 | 2023-05-12 | Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, t… |
CVE-2023-1732 | Medium | 5.3 | 2023-05-10 | When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error. In rare depl… |
CVE-2023-0652 | High | 7.0 | 2023-04-06 | Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0… |
CVE-2023-1412 | High | 7.0 | 2023-04-05 | An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform p… |
CVE-2023-1314 | High | 7.5 | 2023-03-21 | A vulnerability has been discovered in cloudflared's installer (<= 2023.3.0) for Windows 32-bits devices that allows a local attacker with no administrative pe… |
CVE-2022-4457 | Medium | 5.5 | 2023-01-11 | Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a… |
CVE-2022-4428 | High | 8.9 | 2023-01-11 | support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitra… |
CVE-2014-125026 | Critical | 9.8 | 2022-12-27 | LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input. |
CVE-2022-3512 | Medium | 6.7 | 2022-10-28 | Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies… |
CVE-2022-3337 | Medium | 6.7 | 2022-10-28 | It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/clou… |
CVE-2022-3322 | Medium | 6.7 | 2022-10-28 | Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient… |
CVE-2022-3321 | Medium | 6.7 | 2022-10-28 | It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-… |
CVE-2022-3320 | Medium | 6.7 | 2022-10-28 | It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an… |
CVE-2022-3616 | Medium | 5.4 | 2022-10-28 | Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash… |
CVE-2022-2529 | High | 7.5 | 2022-09-30 | sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing… |
CVE-2022-2225 | High | 8.1 | 2022-07-26 | By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security po… |
CVE-2022-2145 | Medium | 5.8 | 2022-06-28 | Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client… |
CVE-2022-2147 | Medium | 6.5 | 2022-06-23 | Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation… |
CVE-2021-3912 | Medium | 4.2 | 2021-11-11 | OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a reposi… |
CVE-2021-3911 | Medium | 4.2 | 2021-11-11 | If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash. |
CVE-2021-3910 | Medium | 4.4 | 2021-11-11 | OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character). |
CVE-2021-3909 | Medium | 4.4 | 2021-11-11 | OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repo… |
CVE-2021-3908 | Medium | 5.9 | 2021-11-11 | OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end. |
CVE-2021-3907 | High | 7.4 | 2021-11-11 | OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/e… |
CVE-2021-3761 | High | 7.5 | 2021-09-09 | Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can… |
CVE-2020-35152 | Medium | 4.5 | 2021-02-03 | Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges… |
CVE-2020-24356 | Medium | 6.4 | 2020-10-02 | `cloudflared` versions prior to 2020.8.1 contain a local privilege escalation vulnerability on Windows systems. When run on a Windows system, `cloudflared` sea… |