Cloudflare has 14 CVEs on record between 2021 and 2026. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 6.1 (medium). None have a confirmed exploitation report. Most affected products: github.com/cloudflare/cfrpki (7), https://github.com/cloudflare/pingora (3), github.com/cloudflare/circl (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Weakness classes
Products
- github.com/cloudflare/cfrpki 7
- https://github.com/cloudflare/pingora 3
- github.com/cloudflare/circl 2
- github.com/cloudflare/cloudflared 1
- github.com/cloudflare/goflow/v3 1
Worst active — by depth score
CVE-2026-105299High· 8.7Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments48CVE-2021-3910High· 7.5NUL character in ROA causes OctoRPKI to crash42CVE-2026-105297High· 7.5Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits41CVE-2023-1314High· 7.5cloudflared's Installer has Local Privilege Escalation Vulnerability41CVE-2022-2529High· 7.5Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package41
Cloudflare vulnerabilities
CVEs affecting Cloudflare, newest first. Open any entry for full detail, references, and exploit status.
14 CVEsRSS
CVE-2026-105297High· 7.5Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send …
CVE-2026-105298Medium· 6.3Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority…
CVE-2026-105299High· 8.7Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop heade…
CVE-2025-8556Low· 3.7CIRCL-Fourq: Missing and wrong validation can lead to incorrect results
CIRCL-Fourq: Missing and wrong validation can lead to incorrect results
CVE-2023-1732Medium· 5.3Improper random reading in CIRCL
Improper random reading in CIRCL
CVE-2023-1314High· 7.5cloudflared's Installer has Local Privilege Escalation Vulnerability
cloudflared's Installer has Local Privilege Escalation Vulnerability
CVE-2022-3616Medium· 5.4OctoRPKI crashes when max iterations is reached
OctoRPKI crashes when max iterations is reached
CVE-2022-2529High· 7.5Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package
CVE-2021-3911Medium· 4.2Misconfigured IP address field in ROA leads to OctoRPKI crash
Misconfigured IP address field in ROA leads to OctoRPKI crash
CVE-2021-3912Medium· 4.2OctoRPKI crashes when processing GZIP bomb returned via malicious repository
OctoRPKI crashes when processing GZIP bomb returned via malicious repository
CVE-2021-3908Medium· 5.9Infinite certificate chain depth results in OctoRPKI running forever
Infinite certificate chain depth results in OctoRPKI running forever
CVE-2021-3909Medium· 4.4Infinite open connection causes OctoRPKI to hang forever
Infinite open connection causes OctoRPKI to hang forever
CVE-2021-3910High· 7.5NUL character in ROA causes OctoRPKI to crash
NUL character in ROA causes OctoRPKI to crash
CVE-2021-3761High· 7.5OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values