Final Friday, Tavis Ormandy from Google’s Undertaking Zero contacted Cloudflare to report a safety problem with our edge servers. He was seeing corrupted web pages being returned by some HTTP requests run through Cloudflare. It turned out that in some unusual circumstances, which I’ll element beneath, our edge servers had been operating past the end of a buffer and returning Memory Wave Experience that contained private information akin to HTTP cookies, authentication tokens, HTTP Publish bodies, and different sensitive knowledge. And a few of that information had been cached by serps. For the avoidance of doubt, Cloudflare customer SSL personal keys weren't leaked. Cloudflare has all the time terminated SSL connections through an isolated occasion of NGINX that was not affected by this bug. We shortly recognized the issue and turned off three minor Cloudflare features (e-mail obfuscation, Server-facet Excludes and Automatic HTTPS Rewrites) that had been all utilizing the identical HTML parser chain that was causing the leakage. At that time it was now not doable for memory to be returned in an HTTP response.

Due to the seriousness of such a bug, a cross-practical crew from software engineering, infosec and operations formed in San Francisco and London to fully understand the underlying trigger, to know the impact of the memory leakage, and to work with Google and other search engines to take away any cached HTTP responses. Having a worldwide crew meant that, at 12 hour intervals, work was handed over between workplaces enabling employees to work on the issue 24 hours a day. The crew has labored continuously to ensure that this bug and its consequences are totally handled. Certainly one of the benefits of being a service is that bugs can go from reported to fixed in minutes to hours instead of months. The trade customary time allowed to deploy a repair for a bug like that is often three months

Edit

Pub: 09 Aug 2025 08:04 UTC

Views: 6