https://vulnogram.org/ Most recent CVEs assigned by Cloudflare, Inc. (cloudflare). https://vulnogram.org/seaview/icons/cloudflare.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-105299 https://vulnogram.org/CVE-2026-105299 Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the heade… High Network Exploitable Tue, 20 Oct 2026 01:07:12 GMT https://vulnogram.org/CVE-2026-105298 https://vulnogram.org/CVE-2026-105298 Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority value, but the… Medium Network Exploitable Tue, 20 Oct 2026 00:46:21 GMT https://vulnogram.org/CVE-2026-105297 https://vulnogram.org/CVE-2026-105297 Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK ref… High Network Exploitable Tue, 20 Oct 2026 00:40:27 GMT https://vulnogram.org/CVE-2026-11325 https://vulnogram.org/CVE-2026-11325 Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful e… High Network Exploitable Wed, 12 Aug 2026 11:31:15 GMT https://vulnogram.org/CVE-2026-12523 https://vulnogram.org/CVE-2026-12523 Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection ma… High Network Exploitable Tue, 14 Jul 2026 15:51:28 GMT https://vulnogram.org/CVE-2026-12707 https://vulnogram.org/CVE-2026-12707 Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. Impact quiche supports the connection migration features described in Section 9 of RFC 9000, w… High Network Exploitable Tue, 14 Jul 2026 15:18:24 GMT https://vulnogram.org/CVE-2026-14440 https://vulnogram.org/CVE-2026-14440 Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the customer's zone. This auto-managed RRset is permissive by design (e.g. 'issue "letsencrypt.org"' w… High Wed, 01 Jul 2026 22:35:10 GMT https://vulnogram.org/CVE-2026-11941 https://vulnogram.org/CVE-2026-11941 Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The “quiche_connection_id_iter_next” and “quiche_conn_retired_scid_next” functions would return a pointer to a “ConnectionId” to the appli… Medium Network Exploitable Fri, 19 Jun 2026 09:55:54 GMT https://vulnogram.org/CVE-2026-2836 https://vulnogram.org/CVE-2026-2836 A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP cache key implementation generates cache keys using only the URI path, excluding critical f… High Network Exploitable Wed, 04 Mar 2026 23:44:56 GMT https://vulnogram.org/CVE-2026-2835 https://vulnogram.org/CVE-2026-2835 An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of mult… Critical Network Exploitable Wed, 04 Mar 2026 23:32:41 GMT https://vulnogram.org/CVE-2026-2833 https://vulnogram.org/CVE-2026-2833 An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a request containing an Upgrade header, causing the proxy to pass through the rest of the b… Critical Network Exploitable Wed, 04 Mar 2026 23:20:51 GMT https://vulnogram.org/CVE-2026-3125 https://vulnogram.org/CVE-2026-3125 A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler.The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ h… High Network Exploitable Wed, 04 Mar 2026 18:14:31 GMT https://vulnogram.org/CVE-2026-1229 https://vulnogram.org/CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug… Low Network Exploitable Tue, 24 Feb 2026 07:58:54 GMT https://vulnogram.org/CVE-2026-1721 https://vulnogram.org/CVE-2026-1721 Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The `error_description` query parameter was directly interpolated into an HTML script tag without proper escaping, allowing att… Medium Network Exploitable Fri, 13 Feb 2026 01:46:48 GMT https://vulnogram.org/CVE-2026-1664 https://vulnogram.org/CVE-2026-1664 Summary An Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function within the Cloudflare Agents SDK. The issue occurs because the `Message-ID` and `References` headers are parsed to derive the target ag… Medium Network Exploitable Tue, 03 Feb 2026 11:39:18 GMT https://vulnogram.org/CVE-2026-0933 https://vulnogram.org/CVE-2026-0933 SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed directly to a shell command without proper validation or sanitization,… High Tue, 20 Jan 2026 22:58:05 GMT https://vulnogram.org/CVE-2025-13353 https://vulnogram.org/CVE-2025-13353 In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is… High Tue, 02 Dec 2025 11:03:21 GMT https://vulnogram.org/CVE-2025-7054 https://vulnogram.org/CVE-2025-7054 Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames. QUIC connections possess a set of connection identifiers (IDs); see Section 5.1 of RFC 9000 https://datatracker.ietf.or… High Network Exploitable Thu, 07 Aug 2025 15:19:29 GMT https://vulnogram.org/CVE-2025-4821 https://vulnogram.org/CVE-2025-4821 Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support. An unauthenticated remote attacker can exploit the vulnerability… High Network Exploitable Wed, 18 Jun 2025 15:47:52 GMT https://vulnogram.org/CVE-2025-4820 https://vulnogram.org/CVE-2025-4820 Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support. An unauthenticated remote attacker can exploit the vulnerability… Medium Network Exploitable Wed, 18 Jun 2025 15:45:49 GMT https://vulnogram.org/CVE-2025-6087 https://vulnogram.org/CVE-2025-6087 A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbit… High Network Exploitable Mon, 16 Jun 2025 18:30:44 GMT https://vulnogram.org/CVE-2025-4366 https://vulnogram.org/CVE-2025-4366 A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache… High Network Exploitable Thu, 22 May 2025 15:50:20 GMT https://vulnogram.org/CVE-2025-4658 https://vulnogram.org/CVE-2025-4658 Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also… Critical Network Exploitable Tue, 13 May 2025 16:33:35 GMT https://vulnogram.org/CVE-2025-3757 https://vulnogram.org/CVE-2025-3757 Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. Critical Network Exploitable Tue, 13 May 2025 16:33:18 GMT https://vulnogram.org/CVE-2025-4144 https://vulnogram.org/CVE-2025-4144 PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.… Medium Network Exploitable Thu, 01 May 2025 00:50:27 GMT https://vulnogram.org/CVE-2025-4143 https://vulnogram.org/CVE-2025-4143 The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on the allowed list of redirect URIs for the given client registration. Fixe… Medium Network Exploitable Thu, 01 May 2025 00:19:52 GMT https://vulnogram.org/CVE-2021-3978 https://vulnogram.org/CVE-2021-3978 When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root ( https://github.com/cloudflare/cfrpki/blob/master/package/octorpk… High Wed, 29 Jan 2025 10:00:53 GMT https://vulnogram.org/CVE-2025-0651 https://vulnogram.org/CVE-2025-0651 Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'R… Medium Wed, 22 Jan 2025 17:34:16 GMT https://vulnogram.org/CVE-2024-1410 https://vulnogram.org/CVE-2024-1410 Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers (IDs); see R… Low Network Exploitable Tue, 12 Mar 2024 18:06:05 GMT https://vulnogram.org/CVE-2024-1765 https://vulnogram.org/CVE-2024-1765 Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vuln… Medium Network Exploitable Tue, 12 Mar 2024 18:04:54 GMT https://vulnogram.org/CVE-2024-0212 https://vulnogram.org/CVE-2024-0212 The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API. High Mon, 29 Jan 2024 09:13:44 GMT https://vulnogram.org/CVE-2023-6992 https://vulnogram.org/CVE-2023-6992 Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacke… Medium Thu, 04 Jan 2024 11:11:07 GMT https://vulnogram.org/CVE-2023-7080 https://vulnogram.org/CVE-2023-7080 The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to… High Fri, 29 Dec 2023 11:58:36 GMT https://vulnogram.org/CVE-2023-7079 https://vulnogram.org/CVE-2023-7079 Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a… Medium Fri, 29 Dec 2023 11:54:08 GMT https://vulnogram.org/CVE-2023-7078 https://vulnogram.org/CVE-2023-7078 Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until… High Fri, 29 Dec 2023 11:53:06 GMT https://vulnogram.org/CVE-2023-6193 https://vulnogram.org/CVE-2023-6193 quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation (RFC 9000 Section 8.2) requires that the recipient of a PATH_CH… Medium Network Exploitable Tue, 12 Dec 2023 13:32:03 GMT https://vulnogram.org/CVE-2023-6180 https://vulnogram.org/CVE-2023-6180 The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The set_ex_data function used by the library did not deallocate memory used by pre-… Medium Network Exploitable Tue, 05 Dec 2023 15:02:40 GMT https://vulnogram.org/CVE-2023-3747 https://vulnogram.org/CVE-2023-3747 Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of server… Medium Thu, 07 Sep 2023 12:11:01 GMT https://vulnogram.org/CVE-2023-0654 https://vulnogram.org/CVE-2023-0654 Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to t… Low Tue, 29 Aug 2023 15:05:19 GMT https://vulnogram.org/CVE-2023-0238 https://vulnogram.org/CVE-2023-0238 Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on a victim's device to exploit a peculiarity in an Android function, wherein under certain co… Low Tue, 29 Aug 2023 14:56:50 GMT https://vulnogram.org/CVE-2023-4241 https://vulnogram.org/CVE-2023-4241 lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected. High Network Exploitable Wed, 16 Aug 2023 10:13:12 GMT https://vulnogram.org/CVE-2023-2754 https://vulnogram.org/CVE-2023-2754 The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WAR… High Network Exploitable Thu, 03 Aug 2023 13:53:00 GMT https://vulnogram.org/CVE-2023-3766 https://vulnogram.org/CVE-2023-3766 A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients and enables an attacker wi… Medium Network Exploitable Thu, 03 Aug 2023 13:49:46 GMT https://vulnogram.org/CVE-2023-3348 https://vulnogram.org/CVE-2023-3348 The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development server for Pages (wrangler pages dev command). This vulnerability enabled an attacker in the s… Medium Thu, 03 Aug 2023 13:47:07 GMT https://vulnogram.org/CVE-2023-1862 https://vulnogram.org/CVE-2023-1862 Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger WARP conne… High Network Exploitable Tue, 20 Jun 2023 08:28:12 GMT https://vulnogram.org/CVE-2023-3040 https://vulnogram.org/CVE-2023-3040 A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access bug that could have allowed an attacker to launch a DoS if the function was used to parse un… Low Network Exploitable Wed, 14 Jun 2023 11:54:51 GMT https://vulnogram.org/CVE-2023-3036 https://vulnogram.org/CVE-2023-3036 An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71 enabled a remote attacker to trigger a panic by sending an NTSAuthenticator pac… High Network Exploitable Wed, 14 Jun 2023 11:08:08 GMT https://vulnogram.org/CVE-2023-2512 https://vulnogram.org/CVE-2023-2512 Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, the forEach() method could end up reading from the wrong location in memory while iterating… Medium Network Exploitable Fri, 12 May 2023 10:09:06 GMT https://vulnogram.org/CVE-2023-1732 https://vulnogram.org/CVE-2023-1732 When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error. In rare deployment cases (error thrown by the Read() function), this could lead to a predictable shared… Medium Wed, 10 May 2023 11:41:53 GMT https://vulnogram.org/CVE-2023-0652 https://vulnogram.org/CVE-2023-0652 Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a malicious attacker to forge the destination of the hardlink and escalate privil… High Thu, 06 Apr 2023 09:42:33 GMT