Cloudflare

OS Command Injection in `wrangler pages deploy`

Arbitrary filepath traversal via URI injection

also in 4 other products

Out of Bounds Slice index in cfnts leads to remote panic

cloudflare/pages-action is deprecated — migration required by September 18th, 2026

HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

Out-of-bounds write in github.com/cloudflare/golz4

also in 1 other product

SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint

Cloudflare Https://github.com/cloudflare/pingora: security vulnerability

HTTP Request Smuggling via Premature Upgrade

Cloudflare Https://github.com/cloudflare/pingora: security vulnerability

Cloudflare Https://github.com/cloudflare/pingora: Allocation of Resources Without Limits or Throttling

Incorrect congestion window growth by invalid ACK ranges

PKCE bypass via downgrade attack

OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values

also in 3 other products

Incorrect calculation in CIRCL secp384r1 CombinedMult

also in 2 other products

Resource exhaustion in quiche HTTP/3 and QPACK layers

Cloudflare-WordPress: Improper Access Control

Unbounded path event queue growth in quiche via peer-driven source connection ID rotation

Multiple DoS Attack Vectors in sflow packet handling

also in 1 other product

support_uri validation missing in WARP client for Windows

Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client

Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche

Infinite open connection causes OctoRPKI to hang forever

also in 4 other products

Arbitrary remote code execution within wrangler dev Workers sandbox

Cache poisoning via insecure-by-default cache key