# cve.now: Cloudflare

The newest entries naming Cloudflare as an affected vendor (up to 200), of 66 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-12708](https://cve.now/CVE-2026-12708.md): Unbounded HTTP/3 Datagram flow map growth in tokio-quiche (CVSS 8.7)
- [CVE-2026-105299](https://cve.now/CVE-2026-105299.md): Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments (CVSS 8.7)
- [CVE-2026-105298](https://cve.now/CVE-2026-105298.md): Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass (CVSS 6.3)
- [CVE-2026-105297](https://cve.now/CVE-2026-105297.md): Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits (CVSS 7.5)
- [CVE-2026-11325](https://cve.now/CVE-2026-11325.md): cloudflare/pages-action is deprecated — migration required by September 18th, 2026 (CVSS 8.8)
- [CVE-2026-12523](https://cve.now/CVE-2026-12523.md): Resource exhaustion in quiche HTTP/3 and QPACK layers (CVSS 7.5)
- [CVE-2026-12707](https://cve.now/CVE-2026-12707.md): Unbounded path event queue growth in quiche via peer-driven source connection ID rotation (CVSS 7.5)
- [CVE-2026-14440](https://cve.now/CVE-2026-14440.md): Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records (CVSS 7.6)
- [CVE-2026-11941](https://cve.now/CVE-2026-11941.md): Use-after-free in connection ID iterator and FFI functions (CVSS 5.6)
- [CVE-2026-2836](https://cve.now/CVE-2026-2836.md): Cache poisoning via insecure-by-default cache key (CVSS 8.4)
- [CVE-2026-2835](https://cve.now/CVE-2026-2835.md): HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing (CVSS 9.3)
- [CVE-2026-2833](https://cve.now/CVE-2026-2833.md): HTTP Request Smuggling via Premature Upgrade (CVSS 9.3)
- [CVE-2026-1229](https://cve.now/CVE-2026-1229.md): Incorrect calculation in CIRCL secp384r1 CombinedMult (CVSS 2.9)
- [CVE-2026-0933](https://cve.now/CVE-2026-0933.md): OS Command Injection in \`wrangler pages deploy\` (CVSS 7.7)
- [CVE-2025-13353](https://cve.now/CVE-2025-13353.md): gokey allows secret recovery from a seed file without the master password (CVSS 7.1)
- [CVE-2025-59427](https://cve.now/CVE-2025-59427.md): Cloudflare vite plugin exposes secrets over the built-in dev server (CVSS 2.9)
- [CVE-2025-7054](https://cve.now/CVE-2025-7054.md): Infinite loop triggered by connection ID retirement (CVSS 8.7)
- [CVE-2025-4821](https://cve.now/CVE-2025-4821.md): Incorrect congestion window growth by invalid ACK ranges (CVSS 7.5)
- [CVE-2025-4820](https://cve.now/CVE-2025-4820.md): Incorrect congestion window growth by optimistic ACK (CVSS 5.3)
- [CVE-2021-3978](https://cve.now/CVE-2021-3978.md): Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki (CVSS 7.5)
- [CVE-2025-0651](https://cve.now/CVE-2025-0651.md): File symlink abuse might lead to deleting files belonging to SYSTEM user (CVSS 6.1)
- [CVE-2024-1410](https://cve.now/CVE-2024-1410.md): Unbounded storage of information related to connection ID retirement, in quiche (CVSS 3.7)
- [CVE-2024-1765](https://cve.now/CVE-2024-1765.md): Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche (CVSS 5.9)
- [CVE-2024-0212](https://cve.now/CVE-2024-0212.md): Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users) (CVSS 8.1)
- [CVE-2023-6992](https://cve.now/CVE-2023-6992.md): Memory corruption issues is Cloudflare zlib implementation (CVSS 4.0)
- [CVE-2023-7080](https://cve.now/CVE-2023-7080.md): Arbitrary remote code execution within wrangler dev Workers sandbox (CVSS 8.5)
- [CVE-2023-7079](https://cve.now/CVE-2023-7079.md): Arbitrary remote file read in Wrangler dev server (CVSS 6.4)
- [CVE-2023-7078](https://cve.now/CVE-2023-7078.md): Server-Side Request Forgery (SSRF) in Miniflare (CVSS 7.5)
- [CVE-2023-6193](https://cve.now/CVE-2023-6193.md): Unbounded queuing of path validation messages in cloudflare-quiche (CVSS 5.3)
- [CVE-2023-6180](https://cve.now/CVE-2023-6180.md): Resource exhaustion via memory leak in tokio-boring (CVSS 5.3)
- [CVE-2023-3747](https://cve.now/CVE-2023-3747.md): Insufficient Validation on Override Codes for Always-Enabled WARP Mode (CVSS 5.5)
- [CVE-2023-0654](https://cve.now/CVE-2023-0654.md): Spoofing User's Activity Loads in WARP Mobile Client (Android) (CVSS 3.9)
- [CVE-2023-0238](https://cve.now/CVE-2023-0238.md): Injecting Activity Loads in WARP Mobile Client (CVSS 3.9)
- [CVE-2023-4241](https://cve.now/CVE-2023-4241.md): lol-html panics on certain HTML inputs (CVSS 7.5)
- [CVE-2023-2754](https://cve.now/CVE-2023-2754.md): Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client (CVSS 7.4)
- [CVE-2023-3766](https://cve.now/CVE-2023-3766.md): Invalid Slice Split Results in Server Panic (CVSS 5.9)
- [CVE-2023-3348](https://cve.now/CVE-2023-3348.md): Directory traversal vulnerability in Cloudflare Wrangler (CVSS 5.7)
- [CVE-2023-1862](https://cve.now/CVE-2023-1862.md): Remote access to warp-svc.exe in Cloudflare WARP (CVSS 7.3)
- [CVE-2023-3040](https://cve.now/CVE-2023-3040.md): Out of Bounds Access Leading to Undefined Behavior (CVSS 3.7)
- [CVE-2023-3036](https://cve.now/CVE-2023-3036.md): Out of Bounds Slice index in cfnts leads to remote panic (CVSS 8.6)
- [CVE-2023-2512](https://cve.now/CVE-2023-2512.md): Buffer under-read in workerd (CVSS 6.5)
- [CVE-2023-1732](https://cve.now/CVE-2023-1732.md): Improper random reading in CIRCL (CVSS 5.3)
- [CVE-2023-0652](https://cve.now/CVE-2023-0652.md): Local Privilege Escalation in Cloudflare WARP Installer (Windows) (CVSS 7.0)
- [CVE-2023-1412](https://cve.now/CVE-2023-1412.md): Local Privilege Escalation Vulnerability in WARP's MSI Installer (CVSS 7.0)
- [CVE-2023-1314](https://cve.now/CVE-2023-1314.md): Local Privilege Escalation Vulnerability in cloudflared's Installer (CVSS 7.5)
- [CVE-2022-4428](https://cve.now/CVE-2022-4428.md): support\_uri validation missing in WARP client for Windows (CVSS 8.9)
- [CVE-2022-4457](https://cve.now/CVE-2022-4457.md): WARP client manifest misconfiguration leading to Task Hijacking (CVSS 5.5)
- [CVE-2022-3320](https://cve.now/CVE-2022-3320.md): Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command (CVSS 6.7)
- [CVE-2022-3322](https://cve.now/CVE-2022-3322.md): Lock WARP switch bypass on WARP mobile client using iOS quick action (CVSS 6.7)
- [CVE-2022-3337](https://cve.now/CVE-2022-3337.md): Lock WARP switch bypass by removing VPN profile on iOS mobile client (CVSS 6.7)
- [CVE-2022-3321](https://cve.now/CVE-2022-3321.md): Lock WARP switch feature bypass on WARP mobile client for iOS (CVSS 6.7)
- [CVE-2022-3512](https://cve.now/CVE-2022-3512.md): Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command (CVSS 6.7)
- [CVE-2022-3616](https://cve.now/CVE-2022-3616.md): OctoRPKI crash when maximum iterations number is reached (CVSS 5.4)
- [CVE-2022-2529](https://cve.now/CVE-2022-2529.md): Multiple DoS Attack Vectors in sflow packet handling (CVSS 7.5)
- [CVE-2022-2225](https://cve.now/CVE-2022-2225.md): Zero Trust Secure Web Gateway policies bypass using WARP client subcommands (CVSS 8.1)
- [CVE-2022-2145](https://cve.now/CVE-2022-2145.md): Cloudlfare WARP Arbitrary File Overwrite (CVSS 5.8)
- [CVE-2022-2147](https://cve.now/CVE-2022-2147.md): Unquoted Service Path in Cloudflare WARP for Windows (CVSS 6.5)
- [CVE-2021-3912](https://cve.now/CVE-2021-3912.md): OctoRPKI crashes when processing GZIP bomb returned via malicious repository (CVSS 4.2)
- [CVE-2021-3911](https://cve.now/CVE-2021-3911.md): Misconfigured IP address field in ROA leads to OctoRPKI crash (CVSS 4.2)
- [CVE-2021-3910](https://cve.now/CVE-2021-3910.md): NUL character in ROA causes OctoRPKI to crash (CVSS 4.4)
- [CVE-2021-3909](https://cve.now/CVE-2021-3909.md): Infinite open connection causes OctoRPKI to hang forever (CVSS 4.4)
- [CVE-2021-3908](https://cve.now/CVE-2021-3908.md): Infinite certificate chain depth results in OctoRPKI running forever (CVSS 5.9)
- [CVE-2021-3907](https://cve.now/CVE-2021-3907.md): Arbitrary filepath traversal via URI injection (CVSS 7.4)
- [CVE-2021-3761](https://cve.now/CVE-2021-3761.md): OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values (CVSS 7.5)
- [CVE-2020-35152](https://cve.now/CVE-2020-35152.md): Privilege escalation through unquoted service binary path on Cloudflare WARP for Windows (CVSS 4.5)
- [CVE-2020-24356](https://cve.now/CVE-2020-24356.md): Local Privilege Escalation in cloudflared (CVSS 6.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/cloudflare
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.