Bugs

January 14, 2026

What came first: the CNAME or the A record?

A recent change to 1.1.1.1 accidentally altered the order of CNAME records in DNS responses, breaking resolution for some clients. This post explores the technical root cause, examines the source code of affected resolvers, and dives into the inherent ambiguities of the DNS RFCs.

January 27, 2025

Over 700 million events/second: How we make sense of too much data

Here we explain how we made our data pipeline scale to 700 million events per second while becoming more resilient than ever before. We share some math behind the approach and some of the designs.

April 3, 2023

mTLS client certificate revocation vulnerability with TLS Session Resumption

This blog post outlines the root cause analysis and solution for a bug found in Cloudflares mTLS implementation

January 18, 2018

However improbable: The story of a processor bug

Processor problems have been in the news lately, due to the Meltdown and Spectre vulnerabilities. But generally, engineers writing software assume that computer hardware operates in a reliable, well-understood fashion, and that any problems lie on the software side of the software-hardware divide.

January 8, 2018

An Explanation of the Meltdown/Spectre Bugs for a Non-Technical Audience

Last week the news of two significant computer bugs was announced. They've been dubbed Meltdown and Spectre and they take advantage of very technical systems that modern CPUs have implemented to make computers extremely fast.

March 1, 2017

Quantifying the Impact of "Cloudbleed"

Last Thursday we released details on a bug in Cloudflare's parser impacting our customers. It was an extremely serious bug that caused data flowing through Cloudflare's network to be leaked onto the Internet.

February 23, 2017

Incident report on memory leak caused by Cloudflare parser bug

Last Friday, Tavis Ormandy from Googles Project Zero contacted Cloudflare to report a security problem with our edge servers. He was seeing corrupted web pages being returned by some HTTP requests run through Cloudflare.

January 1, 2017

How and why the leap second affected Cloudflare DNS

At midnight UTC on New Years Day, deep inside Cloudflares custom RRDNS software, a number went negative when it should always have been, at worst, zero. A little later this negative value caused RRDNS to panic.

July 18, 2016

CloudFlare sites protected from httpoxy

We have rolled out automatic protection for all customers for the the newly announced vulnerability called httpoxy.

October 29, 2015

Creative foot-shooting with Go RWMutex

Hi, I'm Filippo and today I managed to surprise myself! (And not in a good way.) I'm developing a new module ("filter" as we call them) for RRDNS, CloudFlare's Go DNS server.

September 8, 2015

Weird bug of the day: Twitter in-app browser can't visit site

We keep a close eye on tweets that mention CloudFlare because sometimes we get early warning about odd errors that we are not seeing ourselves through our monitoring systems. Towards the end of August we saw a small number of tweets like this one:

March 19, 2015

OpenSSL Security Advisory of 19 March 2015

Today there were multiple vulnerabilities released in OpenSSL, a cryptographic library used by CloudFlare (and most sites on the Internet).

September 30, 2014

Inside Shellshock: How hackers are using it to exploit systems

On Wednesday of last week, details of the Shellshock bash bug emerged. This bug started a scramble to patch computers, servers, routers, firewalls, and other computing appliances using vulnerable versions of bash.

April 11, 2014

Answering the Critical Question: Can You Get Private SSL Keys Using Heartbleed?

Below is what we thought as of 12:27pm UTC. To verify our belief we crowd sourced the investigation. It turns out we were wrong. While it takes effort, it is possible to extract private SSL keys.

April 7, 2014

Staying ahead of OpenSSL vulnerabilities

Today a new vulnerability was announced in OpenSSL 1.0.1 that allows an attacker to reveal up to 64kB of memory to a connected client or server (CVE-2014-0160). We fixed this vulnerability last week before it was made public.

November 18, 2011

Cloudflare Tips: Troubleshooting Common Problems

Debugging technical issues online can be tricky. There are many moving pieces; it can be an isolated network connection with the ISP, an issue with your server or one of CloudFlare's data centers could be temporarily having a problem.